In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a built with VLAN and SRP support, the MSRP attribute lookup writes through a null pointer returned by its allocator when its ten‑entry attribute table is full. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring enough new attributes, and Talker Failed declarations hold table entries that are never released. This causes a crash of the NetX Duo networking stack, resulting in a denial‑of‑service that disables functionality that relies on the affected component. The flaw is associated with CWE‑476 and CWE‑772.

Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a built with VLAN and SRP support are affected. Any deployment that includes the MSRP attribute handling code in those versions remains vulnerable unless a patch or update is applied.

The CVSS score of 7.1 indicates high severity. Because the EPSS score is < 1% and the vulnerability is not listed in CISA KEV, widespread exploitation is not known. The likely attack vector is an unauthenticated station on the same Layer 2 segment sending a sequence of MSRP packets designed to exhaust the attribute table; this is inferred from the description of table exhaustion. If successful, the attacker can cause the component to crash, resulting in a denial‑of‑service condition. No evidence of active exploitation exists at this time.