{"id":"CVE-2026-114408","kind":"vulnerability","aliases":["CVE-2026-114408"],"related":[],"title":"Eclipse ThreadX NetX Duo: forged ICMPv6 messages crash network stack","description":"In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing.","summary":"NetX Duo's IPv6 path MTU handling does not check whether it added a destination entry, so a flood of forged ICMPv6 Packet Too Big messages can leave a NULL pointer dereference. On targets that fault on address 0, the IP helper thread crashes and all network processing stops.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iot","ipv6","netx-duo","runtime","threadx"],"not_affected_if":["ipv6-disabled","non-netx-stack","pmtu-discovery-disabled"],"how_to_check":"- Check whether the device runs Eclipse ThreadX NetX Duo in versions `6.4.5.202504` through `6.5.2.202603a`.\n- Check whether IPv6 path MTU discovery is enabled in the build configuration.","fix":"- Eclipse ThreadX NetX Duo: unknown (the sources do not name a fixed version)","status":"open","published_at":"2026-11-02T16:17:27+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","triaged_at":"2026-11-02T16:26:18+00:00","updated_at":"2026-11-02T16:26:18+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-02T16:26:18Z","model":"claude-haiku-5-5","output":{"fix":"- Eclipse ThreadX NetX Duo: unknown (the sources do not name a fixed version)","reach":"network","title":"Eclipse ThreadX NetX Duo: forged ICMPv6 messages crash network stack","impact":"medium","summary":"NetX Duo's IPv6 path MTU handling does not check whether it added a destination entry, so a flood of forged ICMPv6 Packet Too Big messages can leave a NULL pointer dereference. On targets that fault on address 0, the IP helper thread crashes and all network processing stops.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["threadx","netx-duo","embedded","iot","ipv6"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"network stack crashes and stops all network processing on device","analyst_note":"Find the vendor advisory (github.com linked in sources) to confirm the fixed version and which products ship this build.","how_to_check":"- Check whether the device runs Eclipse ThreadX NetX Duo in versions `6.4.5.202504` through `6.5.2.202603a`.\n- Check whether IPv6 path MTU discovery is enabled in the build configuration.\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["ipv6-disabled","pmtu-discovery-disabled","non-netx-stack"],"who_is_affected":"Only embedded devices built with NetX Duo in the listed versions and with IPv6 path MTU discovery enabled are exposed. An attacker on the same network segment can send the crafted ICMPv6 messages, so devices reachable only from trusted networks carry less risk. unknown for whether any particular product ships this build.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4236,"output_tokens":643,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114408':13A,16A '-2026':12A,15A '0':63B,150C '6.4.5.202504':80C '6.5.2.202603':82C 'add':37B,103C,108C 'address':62B,149C 'big':49B,94C,123C 'built':84C 'check':34B,105C 'crash':8A,68B,142C 'cve':11A,14A 'derefer':56B,138C 'destin':39B,99C,118C,127C 'destination-t':98C 'discoveri':89C 'duo':4A,22B,26B,78C 'eclips':1A,75C 'embed':17B 'entri':40B,101C 'fault':60B,147C 'fill':116C 'flood':43B 'forg':5A,45B 'handl':31B 'handler':95C 'helper':66B,136C 'icmpv6':6A,46B,91C 'iot':18B 'ip':65B,135C 'ipv6':19B,28B,86C 'leav':52B 'make':133C 'messag':7A,50B,124C,132C 'mtu':30B,88C 'network':9A,71B,114C,154C 'netx':3A,21B,25B,77C 'netx-duo':20B 'new':126C 'next':131C 'null':54B,140C 'packet':47B,92C,121C 'path':29B,87C 'pointer':55B,141C 'process':72B,155C 'quot':125C 'runtim':23B 'sender':111C 'stack':10A 'stop':73B,152C 'succeed':109C 'tabl':100C,119C 'target':58B,145C 'thread':67B,137C 'threadx':2A,24B,76C 'use':96C 'version':79C 'whether':35B 'without':104C","nicknames":[],"mitigations":[],"who_affected":"Only embedded devices built with NetX Duo in the listed versions and with IPv6 path MTU discovery enabled are exposed. An attacker on the same network segment can send the crafted ICMPv6 messages, so devices reachable only from trusted networks carry less risk. unknown for whether any particular product ships this build.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","high","iot","ipv6","netxduo","runtime","threadx"],"first_public_at":"2026-11-01T17:32:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114408","severity":null,"published_at":"2026-11-02T16:17:27+00:00","modified_at":"2026-11-02T16:17:27+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","fetched_at":"2026-11-02T16:24:04+00:00","note":null}],"documents":[{"id":52759,"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-xjgr-2wmf-f78j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-01T17:32:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}