CVE-2026-115403: falha de alta gravidade em Eclipse ThreadX
NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.3%
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Eclipse Foundation · Eclipse ThreadXCVEs relacionadas — Eclipse ThreadX
No mesmo produto, das mais perigosas para as menos.
CVE-2026-115215HIGHNetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session poolEPSS 0.4%CVE-2026-95108MEDIUMDeleting a user-mode module thread leaks its privileged kernel stackEPSS 0.2%CVE-2026-95107HIGHModule object allocation size overflow corrupts the manager object poolEPSS 0.2%CVE-2026-94202MEDIUMModule block-pool create validates two of the four parameter words it readsEPSS 0.2%CVE-2026-95109HIGHCortex-A7 module data validation checks only the first address of a caller-supplied rangeEPSS 0.1%CVE-2026-94192HIGHModule object deallocation can free a live ThreadX kernel objectEPSS 0.1%