{"id":"CVE-2026-115403","published":"2026-11-02T22:17:18.543","lastModified":"2026-11-02T22:17:18.543","description":"In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-252","CWE-476"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9w9h-x3fh-m3fp","tags":[]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/500","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9w9h-x3fh-m3fp","tags":[]}],"hasPoc":true,"ai":null}