Mounting an attacker‑controlled NAND flash image triggers an unbounded out‑of‑bounds heap write in LevelX's NAND flash‑translation‑layer metadata parser. The write overwrites a driver function pointer, and the attacker can set RIP to an 8‑byte value of their choosing, achieving a demonstrated control‑flow hijack. Two accompanying out‑of‑bounds reads are also present in the vulnerable code path. This flaw enables remote code execution by constructing a malicious NAND image that the target system mounts.

The affected vendor is Eclipse Foundation, with the LevelX NAND driver used in Eclipse ThreadX and NetX Duo. No specific release version is listed in the advisory; the vulnerability exists in the HEAD commit and likely persists in all recent releases. Any system that embeds the LevelX driver and has a mount interface accepting externally supplied NAND images is impacted.

The CVSS base score of 8.6 indicates high impact. The EPSS score is reported as less than 1%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must have the ability to supply a custom NAND image, implying local or physical access to the device. If such access can be achieved, the severity remains significant and patching is strongly recommended.