{"affected":[{"defaultStatus":"unaffected","product":"Eclipse ThreadX NetX Duo","source":"CNA: eclipse","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"6.5.2.202603a","status":"affected","version":"6.0","versionType":"semver"},{"status":"unaffected","version":"6.5.2.202603b"}]}],"cveId":"CVE-2026-102720","cwes":["CWE-125","CWE-193"],"description":"In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its read pointer for every option it skips. A DHCP server, or any host on the link that answers first, can make the client read up to about a kilobyte past the received message, and the same walk copies out-of-bounds bytes into the application's buffer when it retrieves a user option.","epss":{"date":"2026-11-03","percentile":0.04462,"score":0.00153},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: eclipse","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.3,"severity":"medium","source":"NVD: emo@eclipse.org","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1793787443730,"publishedAt":1790703983228,"references":[{"source":"CNA: eclipse","tags":[],"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-8hj5-p46x-5h28"},{"source":"emo@eclipse.org","tags":[],"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-8hj5-p46x-5h28"}],"remediation":[],"revision":"ee400a60cc0c1a705861992432058c0e8f540b8e656d6ad85fa1c2dcac46c4a4","sources":[{"modifiedAt":1793785354150,"name":"CNA: eclipse","retrievedAt":1793786901054,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102720"},{"modifiedAt":1793787443730,"name":"NVD","retrievedAt":1793794547150,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102720"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793786946765,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102720"}],"ssvc":{"assessedAt":1790706993534,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer","updatedAt":1793794547150}