The HTTP server PUT handler in Eclipse ThreadX NetX Duo incorrectly uses a shared cleanup path that unconditionally calls fx_file_close() even when no file has been successfully opened, resulting in an uninitialized file handle being closed. This undefined behavior can cause double‑close errors or memory corruption, potentially leading to crashes or exploitable conditions.

The vulnerability affects the Eclipse ThreadX NetX Duo product from the Eclipse Foundation. No specific affected version range is listed in the available data.

With a CVSS score of 7.5, the issue presents high severity. The EPSS score is not available, and it is not listed in CISA KEV. The likely attack vector is remote, exploiting the HTTP PUT endpoint to trigger the faulty cleanup path; the impact would be memory corruption in the server process.