CVE-2026-102714: NetX Duo ICMPv6 Buffer Overflow Vulnerability

CVE-2026-102714 Overview

CVE-2026-102714 is an out-of-bounds read vulnerability [CWE-125] in the Eclipse ThreadX NetX Duo networking stack. The flaw resides in _nx_icmpv6_validate_options() at common/src/nx_icmpv6_validate_options.c:79, where the validation loop uses while (length > 2) and leaves a one- or two-byte residue unexamined. Downstream ICMPv6 handlers then re-walk the same buffer without zero-length or remaining-length checks, producing infinite loops, unsigned counter underflows, and off-buffer reads. An attacker on the adjacent network can send crafted Router Advertisement, Neighbor Solicitation, Neighbor Advertisement, or Redirect frames to freeze the IP thread or corrupt neighbor cache entries.

Critical Impact
A single malformed ICMPv6 frame on the local link can halt the highest-priority IP thread until watchdog reset, or cause off-packet memory to be written into the neighbor cache and transmitted on the wire.

Affected Products

Eclipse ThreadX NetX Duo (_nx_icmpv6_validate_options)
Eclipse ThreadX NetX Duo ICMPv6 processors: _nx_icmpv6_process_ra, _nx_icmpv6_process_ns, _nx_icmpv6_process_na, _nx_icmpv6_process_redirect
Embedded systems and IoT devices built on Eclipse ThreadX with IPv6 enabled

Discovery Timeline

2026-09-29 - CVE-2026-102714 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102714

Vulnerability Analysis

The validator _nx_icmpv6_validate_options() iterates option TLVs with the predicate while (length > 2). When the remaining area is exactly one or two bytes, the loop terminates without inspecting the tail. The residue is non-negative, so the function returns NX_SUCCESS, and the zero-length option check never runs against those bytes.

Every consumer of the validated buffer then re-walks the same region, reading a two-byte option header at the residue and subtracting nx_icmpv6_option_length << 3 from unsigned counters. Neither a zero-length check nor a remaining-length check protects the second walk. Attacker-controlled bytes determine which of three failure modes occurs.

Root Cause

The root cause is a boundary condition error combined with missing input validation in a two-pass parser. The first pass validates but leaves a tail. The second pass trusts the validator and reads past it. Because the unsigned counters in _nx_icmpv6_process_ns, _nx_icmpv6_process_na, and _nx_icmpv6_process_redirect cannot represent negative results, an underflow such as 2 - 8 = 0xFFFFFFFA continues the walk far past the packet buffer.

Attack Vector

An adjacent-network attacker sends a crafted ICMPv6 frame whose option area size leaves a one- or two-byte residue. A zero length byte at the residue produces an infinite loop in the IP thread, which is the highest-priority thread and does not yield, halting the system until watchdog reset. A non-zero length byte causes unsigned underflow and a runaway walk that reads past the buffer until a fault or a zero length byte freezes execution. During the runaway walk, bytes parsed as a link-layer address option are copied into the neighbor cache in _nx_icmpv6_process_ns.c:280 and :293, then used as the destination MAC for subsequent frames, placing off-packet memory on the wire.

No public proof-of-concept exploit code is available. See the GitHub Security Advisory GHSA-39p4-p83c-58hr for full technical details.

Detection Methods for CVE-2026-102714

Indicators of Compromise

Unexpected device resets attributed to watchdog timeout on Eclipse ThreadX-based devices with IPv6 enabled
ICMPv6 Router Advertisement, Neighbor Solicitation, Neighbor Advertisement, or Redirect frames whose option area length is not a multiple of 8 bytes
Neighbor cache entries containing implausible or non-conforming MAC addresses
Outbound Ethernet frames whose destination MAC does not correspond to any observed neighbor

Detection Strategies

Inspect ICMPv6 traffic on local segments for option TLVs with length == 0 or with total option area sizes that leave a residue after while (length > 2) validation
Enable IPv6-aware IDS signatures for malformed Neighbor Discovery Protocol (NDP) options
Correlate device reboot telemetry with recent ICMPv6 frames received on the same link

Monitoring Recommendations

Log and alert on ICMPv6 type 133–137 frames from unexpected sources on trusted VLANs
Monitor embedded device uptime and unplanned resets across IoT fleets
Baseline neighbor cache contents on managed devices and alert on entries with unusual MAC prefixes

How to Mitigate CVE-2026-102714

Immediate Actions Required

Apply the vendor fix from the Eclipse ThreadX NetX Duo project as soon as it is available for your build
Restrict ICMPv6 Neighbor Discovery traffic to trusted VLANs and disable IPv6 on interfaces where it is not required
Enforce RA Guard and ND inspection on managed switches to filter malformed Router Advertisement and Neighbor Discovery frames

Patch Information

Refer to the Eclipse ThreadX NetX Duo Security Advisory GHSA-39p4-p83c-58hr for patched commits and release information. Rebuild and redeploy firmware images for all affected embedded devices after applying the upstream fix.

Workarounds

Disable IPv6 in the NetX Duo build configuration if IPv6 connectivity is not required
Place vulnerable devices behind Layer 2 filters that drop ICMPv6 option payloads with non-8-byte-aligned lengths
Segment IoT devices onto dedicated VLANs with strict ingress filtering on ICMPv6 types 133, 134, 135, 136, and 137

bash

# Example: drop ICMPv6 NDP on an untrusted interface using nftables
nft add rule inet filter forward iifname "untrusted0" \
  icmpv6 type { nd-router-solicit, nd-router-advert, \
                nd-neighbor-solicit, nd-neighbor-advert, \
                nd-redirect } drop