CVE-2026-102721

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-11-04

Assigner: Eclipse Foundation

Description

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet without bounding the copy by the end of the datagram, and the TFTP server reads one byte past a minimal ERROR packet. A malicious TFTP server can make the client copy up to 64 bytes of adjacent packet-pool memory into the error string the application retrieves, or fault on targets with memory protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-09-29

EPSS Evaluated

2026-11-07

NVD

CVE-2026-102721

EUVD

EUVD-2026-89185

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse Foundation	NetX Duo	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a TFTP server sending an error packet that is too short. The client reads up to 64 bytes past the received data without proper bounds checking. The error message string is copied without verifying the packet length, allowing a malicious server to read adjacent memory by omitting a null terminator.

Detection Guidance

This vulnerability involves a TFTP server sending malformed ERROR packets that cause buffer overflows. Detection requires monitoring for heap-buffer-overflow errors in TFTP client operations, particularly when processing ERROR packets. Check system logs for AddressSanitizer or similar memory error reports during TFTP operations.

Impact Analysis

An attacker could exploit this to read sensitive memory from the device running the TFTP client. This may expose confidential data or crash the system. The impact depends on what memory is adjacent to the error string buffer.

Compliance Impact

This vulnerability allows a TFTP server to send maliciously crafted ERROR packets that cause a client to read beyond the intended buffer. This could lead to unauthorized access to adjacent memory, potentially exposing sensitive data. For GDPR, this may violate principles of data protection and confidentiality. For HIPAA, it could compromise protected health information if such data resides in the affected memory regions.

Mitigation Strategies

Apply the patch by adding (buffer_ptr < packet_ptr->nx_packet_append_ptr) to the loop condition in all three affected paths in nxd_tftp_client.c. Temporarily disable TFTP services if a patch is unavailable, or restrict TFTP server access to trusted networks only.

Hi! I’m here to help you understand CVE-2026-102721. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...