CVE-2026-102714

Awaiting Analysis Awaiting Analysis - Queue

Integer Underflow in NetXDUO ICMPv6 Option Parsing

Publication date: 2026-09-29

Last updated on: 2026-11-04

Assigner: Eclipse Foundation

Description

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area that ends in a one- or two-byte residue, and the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect handlers then walk it without length checks. A host on the local link can send one such message to make the IP thread read past the packet or loop forever, and can place off-packet memory in the neighbor cache.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-09-29

EPSS Evaluated

2026-11-07

NVD

CVE-2026-102714

EUVD

EUVD-2026-89177

Affected Vendors & Products

Vendor	Product	Version / Range
azure	networking	*
azure	icmpv6	*
azure	neighbor_cache	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1287	The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a function `_nx_icmpv6_validate_options()` that incorrectly validates ICMPv6 option areas. It exits early when a packet leaves a small residue of 1-2 bytes, which are not checked. Consumers then re-process this residue, leading to infinite loops or memory corruption depending on the residue's byte values.

Detection Guidance

This vulnerability involves a loop in ICMPv6 processing that can cause system hangs or crashes. Detection requires monitoring for abnormal ICMPv6 traffic patterns or system freezes. Check for high CPU usage in IP threads or watchdog resets. Use network monitoring tools to inspect ICMPv6 packets for malformed options or infinite loops.

Impact Analysis

An attacker could exploit this to cause a denial of service by triggering infinite loops in critical IP thread functions, halting the system until a watchdog reset. Memory corruption may also occur, potentially allowing unauthorized data access or manipulation of neighbor cache entries.

Compliance Impact

This vulnerability causes denial-of-service conditions by triggering infinite loops in critical network processing functions, which can halt system operations until a watchdog reset. This could lead to prolonged unavailability of services handling sensitive data, potentially violating availability requirements in GDPR and HIPAA.

Mitigation Strategies

Disable ICMPv6 processing if not required. Apply patches from the vendor if available. Use firewalls to filter malformed ICMPv6 packets. Monitor network traffic for suspicious ICMPv6 activity that could trigger the vulnerability.

Hi! I’m here to help you understand CVE-2026-102714. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...