Vulnerability · Published Sep 29, 2026 · Assigned by eclipse
CVE-2026-102721TFTP client and server copy the ERROR packet message without bounding the read against the packet
Medium 6.9
In plain English
A medium-severity out-of-bounds read in Eclipse ThreadX NetX Duo from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet without bounding the copy by the end of the datagram, and the TFTP server reads one byte past a minimal ERROR packet. A malicious TFTP server can make the client copy up to 64 bytes of adjacent packet-pool memory into the error string the application retrieves, or fault on targets with memory protection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse ThreadX NetX Duo | 6.0 – through 6.5.2.202603a |
Weakness: CWE-125 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N