CVE-2026-102715

mDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packet

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Description
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for a longer stored one. A host on the local link can send two mDNS records that make a device performing continuous service discovery write up to three bytes past its transmit packet, corrupting a neighbouring packet or the pool's free list, and misattribute discovered records.

Analysis

AI-generated

Technical impact

A flaw in Eclipse ThreadX NetX Duo’s mDNS string cache accepts a shorter name as a match for a longer stored one, enabling an attacker on the local link to send two mDNS records that cause the device performing continuous service discovery to write up to three bytes past its transmit packet. This overflow corrupts neighboring packet data or the pool's free list, and can lead to data corruption or service disruption, including misattribution of discovered records.

Affected Systems

Eclipse ThreadX/netXduo mDNS component on any build that includes the vulnerable string cache logic. Versions up to and including 6.5.2.202603 are affected.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The exploitation typically requires an attacker to be on the same local area network to send crafted mDNS PTR records. The attack vector is inferred to be local network activity, and while the impact is limited to the affected host’s packet processing, repeated use could degrade network reliability or cause denial of service. The lack of a publicly known exploit makes the immediate risk lower, but the non‑zero CVSS score warrants caution.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Eclipse ThreadX/netXduo firmware that includes the fixed mDNS string alignment check.
  • If a patch is unavailable, disable or remove the mDNS feature from the device to eliminate the vulnerable code path.
  • Segregate network segments so that untrusted hosts cannot reach the vulnerable device via mDNS, and limit mDNS traffic to trusted sources.

Generated by OpenCVE AI on November 4, 2026 at 15:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet mDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packet
Type Values Removed Values Added
Description Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores each name in a slot rounded up to a multiple of four: ```c /* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */ memory_len = ((memory_len & 0xFFFFFFFC) + 8) & 0xFFFFFFFF; ... len = *((USHORT*)(p - 2)); /* slot size, not string length */ if ((len == memory_len) && ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...) ``` The lookup that decides whether an incoming name is already stored compares the rounded slot size, so names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered with the pointer to the first, and the record then carries a string up to three bytes longer than the length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only bound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string. Two PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names whose lengths fall in the same bucket: ``` ==87491==ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 1 at 0x611000000124 thread T5 #0 _nx_mdns_name_string_encode addons/mdns/nxd_mdns.c:13096 #1 _nx_mdns_packet_rr_add addons/mdns/nxd_mdns.c:8911 0x611000000124 is 0 bytes to the right of 228-byte region ``` The overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a normal pool that lands in the next packet in the same pool rather than in a redzone, so the visible effect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash. Compare the slot size against the stored string length before declaring a match, or keep the string length in the slot header and return it to the caller so the encoder and the bound check agree. In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for a longer stored one. A host on the local link can send two mDNS records that make a device performing continuous service discovery write up to three bytes past its transmit packet, corrupting a neighbouring packet or the pool's free list, and misattribute discovered records.
Weaknesses CWE-697
Type Values Removed Values Added
First Time appeared Eclipse
Eclipse threadx Netx Duo
Vendors & Products Eclipse
Eclipse threadx Netx Duo
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores each name in a slot rounded up to a multiple of four: ```c /* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */ memory_len = ((memory_len & 0xFFFFFFFC) + 8) & 0xFFFFFFFF; ... len = *((USHORT*)(p - 2)); /* slot size, not string length */ if ((len == memory_len) && ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...) ``` The lookup that decides whether an incoming name is already stored compares the rounded slot size, so names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered with the pointer to the first, and the record then carries a string up to three bytes longer than the length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only bound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string. Two PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names whose lengths fall in the same bucket: ``` ==87491==ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 1 at 0x611000000124 thread T5 #0 _nx_mdns_name_string_encode addons/mdns/nxd_mdns.c:13096 #1 _nx_mdns_packet_rr_add addons/mdns/nxd_mdns.c:8911 0x611000000124 is 0 bytes to the right of 228-byte region ``` The overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a normal pool that lands in the next packet in the same pool rather than in a redzone, so the visible effect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash. Compare the slot size against the stored string length before declaring a match, or keep the string length in the slot header and return it to the caller so the encoder and the bound check agree.
Title mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet
Weaknesses CWE-787
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
eclipse
Published
Updated
Nov 10, 2026, 3:50 PM
Reserved
Sep 29, 2026, 4:15 PM

View source JSON

Updated
Sep 29, 2026, 6:41 PM

JSON

Status
Awaiting Analysis
Published
Sep 29, 2026, 6:17 PM
Modified
Nov 4, 2026, 2:17 PM

View source JSON

No data.

Updated
Nov 4, 2026, 3:15 PM

JSON