36 matches found
CVE-2026-116569
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrpparsebuffer subtracted delimiter framing from a peer-controlled short segment whose MSRP byte...
CVE-2026-116569 FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrpparsebuffer subtracted delimiter framing from a peer-controlled short segment whose MSRP byte...
CVE-2026-116569
The FreeSWITCH software (versions prior to 1.11.2 ) contains a pre-authentication out-of-bounds write vulnerability within the msrp_parse_buffer() function. The flaw occurs because the system subtracts delimiter framing from a peer-controlled short segment without verifying the segment's length. ...
CVE-2026-116569 FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrpparsebuffer subtracted delimiter framing from a peer-controlled short segment whose MSRP byte...
CVE-2026-102725
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list length from the received frame without comparing it with the packet length. An unauthenticated station on the same Layer 2 segment can send a short MSRP frame...
CVE-2026-102724
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring...
CVE-2026-102723
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through the null pointer returned by its allocator when the ten-entry attribute table is full. An unauthenticated station on the same Layer 2 segment can fault the M...
CVE-2026-102725 Out-of-bounds Read from Unvalidated MSRP Attribute List Length
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list length from the received frame without comparing it with the packet length. An unauthenticated station on the same Layer 2 segment can send a short MSRP frame...
CVE-2026-102725
Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a are vulnerable to an out-of-bounds read in the MSRP parser when built with VLAN and SRP support. The vulnerability exists because the parser uses the attribute list length from a received frame without verifying it against the actual p...
CVE-2026-102725 Out-of-bounds Read from Unvalidated MSRP Attribute List Length
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list length from the received frame without comparing it with the packet length. An unauthenticated station on the same Layer 2 segment can send a short MSRP frame...
CVE-2026-102725
Out-of-bounds Read from Unvalidated MSRP Attribute List Length...
CVE-2026-102725 Out-of-bounds Read from Unvalidated MSRP Attribute List Length
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list length from the received frame without comparing it with the packet length. An unauthenticated station on the same Layer 2 segment can send a short MSRP frame...
EUVD-2026-89191
Out-of-bounds Read from Unvalidated MSRP Attribute List Length...
CVE-2026-102724 NULL pointer dereference when evicting the last MSRP attribute in a participant's list
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring...
CVE-2026-102724
NULL Pointer Dereference When Evicting the Sole MSRP Attribute...
EUVD-2026-89190
NULL Pointer Dereference When Evicting the Sole MSRP Attribute...
CVE-2026-102724 NULL pointer dereference when evicting the last MSRP attribute in a participant's list
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring...
CVE-2026-102724
Eclipse ThreadX NetX Duo (versions 6.4.0 through 6.5.2.202603a) built with VLAN and SRP support is vulnerable to a NULL pointer dereference . The issue occurs when evicting the last attribute in an MRP participant's list , causing the system to write through a null successor pointer. This can lea...
CVE-2026-102724 NULL pointer dereference when evicting the last MSRP attribute in a participant's list
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring...