The vulnerability arises from a shared cleanup label introduced in the security fix for CVE-2025-0728, which unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to this cleanup label before any file open operation, causing fx_file_close() to operate on an uninitialized file handle. This results in a double free condition or memory corruption in the HTTP server PUT process of Eclipse ThreadX - NetX Duo.

Successful exploitation of this vulnerability can cause memory corruption or double free conditions, potentially leading to application crashes or denial of service. The CVSS score of 7.5 indicates high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor Eclipse Foundation advisories for updates and apply any forthcoming patches promptly. Until a fix is available, cautious use or disabling of the affected HTTP server PUT functionality may reduce risk.