CVE-2026-102720

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-102720

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102720.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-102720

Aliases

GHSA-8hj5-p46x-5h28

Published

2026-09-29T17:46:23Z

Modified

2026-11-07T10:47:27Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer

Details

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its read pointer for every option it skips. A DHCP server, or any host on the link that answers first, can make the client read up to about a kilobyte past the received message, and the same walk copies out-of-bounds bytes into the application's buffer when it retrieves a user option.

Database specific

{
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-125",
        "CWE-193"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102720.json"
}

References

Affected packages

Git / github.com/eclipse-threadx/netxduo

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-threadx/netxduo

Events

Introduced

009da2f05a9fc098b8d699b2b814e515631d41cb

Last Affected

c690f59f9a5195c465153e90ef56b865337a8a62

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "6.0"
                },
                {
                    "last_affected": "6.5.2.202603a"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "6.0"
                },
                {
                    "last_affected": "6.5.2.202603a"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

Other

untagged-8ce20f6a594ac40f0829

v.*

v.6.4.4.202503_rel

v6.*

v6.0.1_rel

v6.0.2_rel

v6.0_rel

v6.1.10_rel

v6.1.11_rel

v6.1.12_rel

v6.1.2_rel

v6.1.3_rel

v6.1.4_rel

v6.1.5_rel

v6.1.6_rel

v6.1.7_rel

v6.1.8_rel

v6.1.9_rel

v6.1_rel

v6.2.0_rel

v6.2.1_rel

v6.3.0_rel

v6.4.0_rel

v6.4.1_rel

v6.4.2_rel

v6.4.3_rel

v6.4.4.202503a

v6.4.5.202504_rel

v6.5.0.202601_rel

v6.5.1.202602_rel

v6.5.2.202603_rel

v6.5.2.202603a_rel

v6.5.2.202603b_rel

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102720.json"