A NULL pointer dereference occurs in the BSD raw IPv6 send path of Eclipse ThreadX NetX Duo when the destination table is full and an off‑link destination is reached through a default router with an unknown neighbour cache entry. The software does not verify that adding the table entry succeeded, so sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer. This results in a crash of the sending thread, causing a denial of service to any application that attempts to use raw IPv6 sockets.

Embedded systems running Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a that have BSD raw socket and IPv6 support enabled.

With a CVSS score of 8.2 the vulnerability is considered high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by flooding the destination table with ICMPv6 Packet Too Big messages, then sending a raw IPv6 packet to trigger the crash. The attack requires network connectivity to the affected device and the ability to generate the specific ICMPv6 traffic. Once executed, the attack disrupts network operations by crashing the sending thread and potentially cascading to higher‑level packet processing.