Vulnerability · Published Sep 29, 2026 · Assigned by eclipse
CVE-2026-102723NULL Pointer Dereference on MSRP Attribute Table Exhaustion
High 7.1
In plain English
A high-severity null pointer dereference in Eclipse ThreadX NetX Duo from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through the null pointer returned by its allocator when the ten-entry attribute table is full. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring enough new attributes, and Talker Failed declarations hold table entries that are never released.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse ThreadX NetX Duo | 6.4.0 – through 6.5.2.202603a |
Weakness: CWE-476, CWE-772 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N