The vulnerability lies in the NetX Duo MQTT client, where malformed PUBLISH messages cause the client to leak packets carrying the message from the network driver's receive pool without returning them. Each malformed message consumes one packet, or one chain of packets, from the pool. An attacker can send a series of such malformed messages, exhausting the pool and stopping all inbound network traffic until the device is rebooted. This leads to a denial of service. The weakness is a memory leak as identified by CWE-401.

The affected product is the NetX Duo networking stack provided by the Eclipse Foundation. Versions are not specified in the advisory, so all builds of the MQTT client component that handle PUBLISH messages are potentially vulnerable.

The CVSS score for this vulnerability is 8.2, indicating high severity, but the EPSS score is not available and it is not listed in the CISA KEV catalog, suggesting that exploitation may not be widely observed yet. The likely attack vector is remote, where an attacker can connect to the MQTT broker or device and send a sequence of malformed PUBLISH messages. Each message decreases the available receive pool size, and once the pool is exhausted, the device rejects all inbound traffic. A successful exploitation requires only network access and is straightforward to implement using custom MQTT clients.