CVE-2026-102723 — Vulnerability intelligence
—
Published:
- CVSS
- 7.1
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through the null pointer returned by its allocator when the ten-entry attribute table is full. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring enough new attributes, and Talker Failed declarations hold table entries that are never released.