{"affected":[{"defaultStatus":"unaffected","product":"Eclipse ThreadX NetX Duo","source":"CNA: eclipse","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"6.5.2.202603","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.2.202603a","versionType":"custom"}]}],"cveId":"CVE-2026-102714","cwes":["CWE-125","CWE-191","CWE-835","CWE-1287"],"description":"In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area that ends in a one- or two-byte residue, and the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect handlers then walk it without length checks. A host on the local link can send one such message to make the IP thread read past the packet or loop forever, and can place off-packet memory in the neighbor cache.","epss":{"date":"2026-11-03","percentile":0.04461,"score":0.00153},"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: eclipse","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793797607699,"publishedAt":1790703688517,"references":[{"source":"CNA: eclipse","tags":[],"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-39p4-p83c-58hr"}],"remediation":[],"revision":"047b20d94e1b82be57d897360ea06bf6075b7f5cf185cb1af76b163734bcb982","sources":[{"modifiedAt":1793797607699,"name":"CNA: eclipse","retrievedAt":1793801313975,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102714"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793801415042,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102714"}],"ssvc":{"assessedAt":1790707356412,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop","updatedAt":1793801415042}