TI-2026-65494 Aliases CVE-2026-102761 GHSA-mjm4-7228-hgjf

Out-of-bounds write in Eclipse Foundation NetX Duo

MEDIUM 48CWE-787Published 2026-09-29 · Updated 2026-09-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet's unused payload area and on through the second packet's `NX_PACKET` control block. The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00253 16th percentileScored 2026-11-07

Fix Fixed NetX Duo (Eclipse Foundation): 6.5.2.202603

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Eclipse Foundation	NetX Duo	6.2.0 – 6.5.1.202602	6.5.2.202603	Patch available	CNA

NetX Duo VendorEclipse Foundation Affected 6.2.0 – 6.5.1.202602 Fixed in 6.5.2.202603 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:eclipse:threadx_netx_duo::::::::	—	—	Eclipse Foundation

cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:* Versions — — ·Eclipse Foundation

Remediation

Fix · CNA NetX Duo (Eclipse Foundation) Fixed in 6.5.2.202603

Timeline

2026-10-02 Threatist record created from CVE-2026-102761
2026-10-03 Alias added: GHSA-mjm4-7228-hgjf

References

Other 1

https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-6xgx-v7gw-qjph

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3

See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences