In Eclipse ThreadX NetX Duo firmware up to and including 6.5.2.202603, the ICMPv6 option validator accepts an option area that ends in a one- or two-byte residue. The router advertisement, neighbor solicitation, neighbor advertisement, and redirect handlers then walk this area without performing length checks, creating an out‑of‑bounds read or infinite loop. An attacker who can send a single crafted ICMPv6 message on the local link can cause the IP thread to read past the packet boundary or loop forever, and can place off‑packet memory into the neighbor cache. This creates both memory corruption and a denial of service by halting the high‑priority IP thread until the system is reset.

The vulnerability exists in the Eclipse Foundation’s ThreadX NetX Duo network stack. Firmware builds that incorporate the _nx_icmpv6_validate_options function without the later correction and are compiled with IPv6 support are affected. Versions 6.5.2.202603 and earlier are at risk when deployed on devices that use NetX Duo.

The CVSS score of 7.1 indicates a moderate to high impact risk, while the EPSS score of < 1% shows a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no active exploitation campaigns are known. Based on the description, the attacker needs only the ability to transmit crafted ICMPv6 packets to a host on the same local link; no special privileges or remote access are required. The exploit can lead to a denial of service by causing the system’s networking stack to become unresponsive.