{"affected":[{"defaultStatus":"unaffected","product":"Eclipse ThreadX NetX Duo","source":"CNA: eclipse","vendor":"Eclipse Foundation","versions":[{"status":"affected","version":"HEAD `9f1cfdc` and prior; Finding 1 introduced by commit `47b2a17d`; Finding 2 is   the un-patched half of the Nov-2025 fix `0f7dd521`.","versionType":"custom"}]}],"cveId":"CVE-2026-102730","cwes":["CWE-787","CWE-1284"],"description":"Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`.","epss":{"date":"2026-11-03","percentile":0.01651,"score":0.00117},"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: eclipse","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793798899188,"publishedAt":1790704770553,"references":[{"source":"CNA: eclipse","tags":[],"url":"https://github.com/eclipse-threadx/levelx/security/advisories/GHSA-q6ph-7238-777g"}],"remediation":[],"revision":"1306e1568677a23a2f585e054a4c4521f23a14682d97354c78584ad8486721bd","sources":[{"modifiedAt":1793798899188,"name":"CNA: eclipse","retrievedAt":1793801324140,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102730"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793801406572,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102730"}],"ssvc":{"assessedAt":1790706274920,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX","updatedAt":1793801406572}