Eclipse ThreadX NetX Duo versions up to 6.5.2.202603 that are compiled with DTLS server support contain an out‑of‑bounds read in the ClientHello parser. The parser reads the session ID, cookie and cipher suite list without ensuring the declared lengths fit within the remaining bytes of the message. An attacker can send a ClientHello packet with field lengths that exceed the actual payload size, causing the server to read beyond the buffer. This read does not return any data to the attacker and does not expose existing memory contents; however, on systems where the OOB read faults, the DTLS process may crash, leading to a denial of service. The vulnerability requires no authentication and can be triggered over the network by any remote peer capable of establishing a DTLS connection. It is not a confidentiality or integrity problem, but rather an availability issue that can disrupt network services relying on the affected DTLS implementation. The CVSS v3.1 score of 6.3 indicates a moderate severity flaw. The EPSS score is reported as < 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Remote attackers can exploit it by simply sending a malformed DTLS ClientHello; no special privileges or privileged code execution are required. Availability is the only impacted asset, with the risk of temporary interruption or interruption of service to clients communicating over DTLS.

The flaw affects all builds of Eclipse ThreadX NetX Duo from the Eclipse Foundation with DTLS server support, specifically versions 6.5.2.202603 and earlier. Any firmware that includes the vulnerable DTLS ClientHello parser is potentially impacted.

The moderate CVSS score and extremely low EPSS percentage reflect that while the attack vector is straightforward—a remote peer can send a crafted packet—actual exploitation is unlikely to be widespread. The lack of KEV listing indicates no confirmed field‑tested attacks as of now. The impact is limited to service disruption, but for high‑availability or critical systems it could still represent a significant risk if the vulnerable firmware is in use and unpatched.