CVE-2026-102721

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-102721

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102721.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-102721

Aliases

GHSA-wvc9-5m9h-rvxc

Published

2026-09-29T17:47:12Z

Modified

2026-11-07T10:47:27Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

TFTP client and server copy the ERROR packet message without bounding the read against the packet

Details

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet without bounding the copy by the end of the datagram, and the TFTP server reads one byte past a minimal ERROR packet. A malicious TFTP server can make the client copy up to 64 bytes of adjacent packet-pool memory into the error string the application retrieves, or fault on targets with memory protection.

Database specific

{
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102721.json"
}

References

Affected packages

Git / github.com/eclipse-threadx/netxduo

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-threadx/netxduo

Events

Introduced

009da2f05a9fc098b8d699b2b814e515631d41cb

Last Affected

c690f59f9a5195c465153e90ef56b865337a8a62

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "6.0"
                },
                {
                    "last_affected": "6.5.2.202603a"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "6.0"
                },
                {
                    "last_affected": "6.5.2.202603a"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

Other

untagged-8ce20f6a594ac40f0829

v.*

v.6.4.4.202503_rel

v6.*

v6.0.1_rel

v6.0.2_rel

v6.0_rel

v6.1.10_rel

v6.1.11_rel

v6.1.12_rel

v6.1.2_rel

v6.1.3_rel

v6.1.4_rel

v6.1.5_rel

v6.1.6_rel

v6.1.7_rel

v6.1.8_rel

v6.1.9_rel

v6.1_rel

v6.2.0_rel

v6.2.1_rel

v6.3.0_rel

v6.4.0_rel

v6.4.1_rel

v6.4.2_rel

v6.4.3_rel

v6.4.4.202503a

v6.4.5.202504_rel

v6.5.0.202601_rel

v6.5.1.202602_rel

v6.5.2.202603_rel

v6.5.2.202603a_rel

v6.5.2.202603b_rel

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102721.json"