This vulnerability arises from a refactoring of error handling in the HTTP server PUT process of Eclipse ThreadX - NetX Duo. The shared cleanup label unconditionally calls fx_file_close(), which closes a file handle. However, multiple error branches jump to this cleanup label before any file open operation occurs, causing fx_file_close() to operate on an uninitialized file handle. This results in a double free or memory corruption condition, potentially destabilizing the system or causing crashes. The affected version explicitly identified is 6.4.2. There is no vendor-provided patch or remediation level information available at this time.

The vulnerability can lead to denial of service through application crashes or memory corruption due to double free of file handles. There is no indication of confidentiality or integrity impact. The CVSS v3.1 score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific workaround or temporary fix is provided in the available data.