---
id: "CVE-2026-115403"
kind: "vulnerability"
aliases: ["CVE-2026-115403"]
title: "Eclipse ThreadX NetX Duo: IPv6 raw send NULL pointer crash"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "netxduo", "fixed": ["6.5.2.202603b"], "affected": ">= 6.0, <= 6.5.2.202603a", "ecosystem": "vendor"}]
ecosystems: []
tags: ["embedded", "ipv6", "netx-duo", "runtime", "threadx"]
not_affected_if: ["ipv6-disabled", "no-raw-sockets"]
published_at: "2026-11-02T22:17:18+00:00"
first_seen_at: "2026-11-02T22:35:43+00:00"
updated_at: "2026-11-02T22:38:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115403", "first_seen_at": "2026-11-02T22:35:43+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T22:38:48+00:00"}]
---

# Eclipse ThreadX NetX Duo: IPv6 raw send NULL pointer crash

Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, do not check whether a destination-table add succeeded. A remote sender who fills the table, for example with ICMPv6 Packet Too Big messages, can trigger a NULL pointer dereference that crashes the sending thread.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:netxduo affected >= 6.0, <= 6.5.2.202603a fixed 6.5.2.202603b

## How to check

- Check whether your NetX Duo version is between 6.0 and 6.5.2.202603a (fixed in 6.5.2.202603b).
- Check that the build defines NX_BSD_RAW_SUPPORT with IPv6 enabled, and that the app sends raw IPv6 packets with IP_RAW_IPV6_HDRINCL to off-link destinations.
- Workarounds: avoid IP_RAW_IPV6_HDRINCL sends to off-link destinations; build without NX_BSD_RAW_SUPPORT; raising NX_IPV6_DESTINATION_TABLE_SIZE only makes it harder to trigger, not a fix.

## Fix

Upgrade NetX Duo to 6.5.2.202603b

## Timeline

- 2026-11-02T22:35:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115403
- 2026-11-02T22:38:48+00:00 analyst — Read vendor GHSA via WebFetch (web-cli returned empty): affected >=6.0 <=6.5.2.202603a, fixed 6.5.2.202603b, workarounds listed. X not checked. No exploitation/PoC seen.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9w9h-x3fh-m3fp

## From the sources

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_