The vulnerability in NetX Duo's WebSocket client arises from resetting the unmasking cursor to the first NX_PACKET each time it advances through a chained packet, while the loop's upper bound is limited to the current packet. This mismatch causes the XOR loop to write through the first packet's unused payload area and into the second packet's NX_PACKET control block when processing a masked server frame split across two packets. The four-byte WebSocket masking key controls the bytes written, making the corruption attacker-controlled and exploitable for memory corruption.

This vulnerability allows an unauthenticated remote attacker to perform an out-of-bounds write with attacker-controlled data, potentially leading to memory corruption. Given the critical CVSS score of 9.3 and the nature of the flaw, this could result in denial of service, data corruption, or potentially arbitrary code execution depending on the context and exploitation conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Users should monitor Eclipse Foundation advisories for updates and apply patches once available.