Eclipse ThreadX NetX Duo 6.4.06.5.2 Null Ptr Write in MRP worker
CVE-2026-102724 Published on September 29, 2026
NULL pointer dereference when evicting the last MSRP attribute in a participant's list
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring one MSRP attribute and withdrawing it, and ordinary withdrawals by legitimate stations reach the same path.
Vulnerability Analysis
Weakness Type
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.
Products Associated with CVE-2026-102724
Want to know whenever a new CVE is published for Eclipse Threadx Netx Duo? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse ThreadX NetX Duo:- Version 6.4.0, <= 6.5.2.202603a is affected.
- Version 6.5.2.202603b is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.