This vulnerability (CVE-2026-102726) in Eclipse Foundation NetX Duo arises from unbounded parsing of PPP IPCP options, resulting in an out-of-bounds read and a potential worker stall. The flaw is classified under CWE-125 (Out-of-bounds Read) and CWE-835 (Loop with Unreachable Exit Condition). It affects all versions up to and including 6.5.1.202602. The CVSS 4.0 score is 6.0 (medium), with an attack vector requiring adjacent network access, low attack complexity, no privileges required, no user interaction, low confidentiality impact, no integrity or availability impact, and high vulnerability age. No vendor advisory or patch information is currently available.

The vulnerability can cause a worker stall and out-of-bounds read, potentially leading to denial of service conditions. Confidentiality impact is low, with no integrity or availability impacts reported. The flaw requires an attacker to have adjacent network access but does not require privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is currently available. Monitor vendor communications for updates.