In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, the ICMPv6 Packet Too Big handler uses a destination-table entry it adds without verifying that the addition succeeded, leading to a NULL pointer dereference. This flaw can cause the IP helper thread to crash, shutting down all network operations and potentially leaving the device in a non‑network‑functional state. The weakness is expressed as an unchecked return value and a null pointer dereference (CWE-252, CWE-476).

The affected products are Eclipse ThreadX NetX Duo firmware when built with IPv6 Path MTU Discovery enabled. All releases from version 6.4.5.202504 up to and including 6.5.2.202603a are vulnerable. No other vendors or product versions are listed.

The flaw carries a CVSS base score of 8.7, indicating high severity. The EPSS score is not available, which suggests no current data on exploit frequency but does not preclude the possibility. Because the vulnerability is triggered by receiving ICMPv6 Packet Too Big messages, an attacker can send such messages from the network to exhaust the destination table. The likely attack vector is from external network traffic; no authentication is required. The flaw is not listed in the CISA KEV catalog, so there is no publicly documented active exploitation pipeline, but the high CVSS and the ability to crash network services make it a significant denial‑of‑service risk.