This vulnerability (CVE-2026-102725) in Eclipse Foundation's NetX Duo involves an out-of-bounds read caused by improper validation of the MSRP attribute list length. This flaw could lead to reading memory beyond the intended buffer boundaries. The affected versions are from 0 through 6.5.1.202602 inclusive. The CVSS 4.0 vector indicates the attack vector is adjacent network (AV:A), low attack complexity (AC:L), requires no privileges (PR:N), no user interaction (UI:N), and has high impact on availability (VA:H). No vendor advisory or patch information is currently available.

The vulnerability allows an attacker with adjacent network access to cause an out-of-bounds read, which may lead to application crashes or denial of service due to high impact on availability. There is no indication of confidentiality or integrity impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided, users should monitor vendor communications for updates. Restricting access to the vulnerable service from untrusted networks may reduce exposure.