The vulnerability lies in the MSRP parser of Eclipse ThreadX NetX Duo. The parser uses an attribute list length value from the received frame without validating it against the overall packet size. An unauthenticated station on the same Layer 2 segment can send a short MSRP frame that advertises a long list, causing the MRP worker to read memory far beyond the received packet boundaries, potentially triggering a fault on memory‑protected targets. This out‑of‑bounds read falls under CWE‑125 and may expose sensitive data to the attacker.

Affected products are systems running the Eclipse Foundation NetX Duo real‑time operating system. Versions 6.4.0 through 6.5.2.202603a built with VLAN and SRP support are impacted. Any NetX Duo deployment with those versions on a Layer 2 network is vulnerable unless a patch is applied.

The CVSS score of 7.1 marks the flaw as high severity. The EPSS score of < 1% indicates a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an unauthenticated device on the same Layer 2 segment to send a crafted short MSRP frame with an inflated attribute list length. The flaw can cause an application fault or memory read that may expose data, but it does not grant arbitrary code execution. No privileged access is required beyond network proximity. Since affected versions are identified, a timely patch mitigates the risk.