CVE-2026-102720 — Vulnerability intelligence
—
Published:
- CVSS
- 5.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its read pointer for every option it skips. A DHCP server, or any host on the link that answers first, can make the client read up to about a kilobyte past the received message, and the same walk copies out-of-bounds bytes into the application's buffer when it retrieves a user option.