CVE-2026-102724

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring...

CVE-2026-102725 Out-of-bounds Read from Unvalidated MSRP Attribute List Length

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list length from the received frame without comparing it with the packet length. An unauthenticated station on the same Layer 2 segment can send a short MSRP frame...

CVE-2026-102725

Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a are vulnerable to an out-of-bounds read in the MSRP parser when built with VLAN and SRP support. The vulnerability exists because the parser uses the attribute list length from a received frame without verifying it against the actual p...

CVE-2026-102725

Out-of-bounds Read from Unvalidated MSRP Attribute List Length...

EUVD-2026-89191

Out-of-bounds Read from Unvalidated MSRP Attribute List Length...

CVE-2026-102724 NULL pointer dereference when evicting the last MSRP attribute in a participant's list

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring...

CVE-2026-102724

NULL Pointer Dereference When Evicting the Sole MSRP Attribute...

EUVD-2026-89190

NULL Pointer Dereference When Evicting the Sole MSRP Attribute...

CVE-2026-102724 NULL pointer dereference when evicting the last MSRP attribute in a participant's list

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring...

CVE-2026-102724 NULL pointer dereference when evicting the last MSRP attribute in a participant's list

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring...

CVE-2026-102724

Eclipse ThreadX NetX Duo (versions 6.4.0 through 6.5.2.202603a) built with VLAN and SRP support is vulnerable to a NULL pointer dereference . The issue occurs when evicting the last attribute in an MRP participant's list , causing the system to write through a null successor pointer. This can lea...

CVE-2026-102723

NULL Pointer Dereference on MSRP Attribute Table Exhaustion...

EUVD-2026-89189

NULL Pointer Dereference on MSRP Attribute Table Exhaustion...

CVE-2026-102723 NULL Pointer Dereference on MSRP Attribute Table Exhaustion

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through the null pointer returned by its allocator when the ten-entry attribute table is full. An unauthenticated station on the same Layer 2 segment can fault the M...

CVE-2026-102723 NULL Pointer Dereference on MSRP Attribute Table Exhaustion

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through the null pointer returned by its allocator when the ten-entry attribute table is full. An unauthenticated station on the same Layer 2 segment can fault the M...

CVE-2026-102723: NULL Pointer Dereference

NULL Pointer Dereference on MSRP Attribute Table Exhaustion...

PT-2026-102790

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A NULL pointer dereference occurs when evicting the sole MSRP Media Service Resource Protocol attribute. A NULL pointer dereference is a software error where th...

PT-2026-102789

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A NULL pointer dereference occurs when the MSRP attribute table is exhausted. A NULL pointer dereference is a type of software error where a program attempts to...

CVE-2026-102724: NULL Pointer Dereference

NULL Pointer Dereference When Evicting the Sole MSRP Attribute...

PT-2026-102791

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An out-of-bounds read occurs due to the use of an unvalidated MSRP attribute list length. This issue allows the system to read data beyond the intended buffer...