CVE Feed

    Dashboard / CVE / CVE-2026-115403

    CVE-2026-115403

    In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.

    Published:Nov 2, 2026
    Last Modified:Nov 2, 2026
    EPS:Nov 2, 2026
    EPSS Score:
    CVSS Score:8.2

    Affected Products

    Vendor
    Eclipse
    Product
    Threadx

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-113421 (CVSS 7.3) — In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffe…
    CVE-2026-115231 (CVSS 8.5) — In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected …
    CVE-2026-115215 (CVSS 8.7) — In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a sessio…
    CVE-2026-115654 (CVSS 6.9) — In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not ch…
    CVE-2026-115653 (CVSS 7) — In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves …
    CVE-2026-114408 (CVSS 8.7) — In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, t…
    CVE-2026-118052 (CVSS 6.8) — In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error wi…
    CVE-2026-95107 (CVSS 7) — A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its…
    CVE-2026-94202 (CVSS 4.8) — The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter ar…
    CVE-2026-95108 (CVSS 6.8) — One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High