CVE-2026-102714 ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop

Description

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area that ends in a one- or two-byte residue, and the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect handlers then walk it without length checks. A host on the local link can send one such message to make the IP thread read past the packet or loop forever, and can place off-packet memory in the neighbor cache.

Exploitable from the adjacent network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Adjacent network

Attack complexity

Low

Attack requirements

None

Privileges required

None

Interaction

None

Confidentiality

None

Integrity

None

Availability

High

Confidentiality of other systems

None

Integrity of other systems

None

Availability of other systems

None

Affected products and versions