This vulnerability arises from improper input validation (CWE-20) in the NAT64 translator component of OpenThread before commit 26a882d. An attacker positioned on the adjacent IPv4 network can exploit this flaw by sending specially crafted IPv4 packets with options that result in corrupted IPv6 packets being injected into the Thread mesh network or security checks being bypassed. The CVSS 4.0 base score is 6.0, indicating medium severity, with attack vector local to adjacent network, low attack complexity, and no privileges or user interaction required.

Successful exploitation could allow an attacker on the adjacent IPv4 network to inject malformed IPv6 packets into the Thread mesh network or bypass security checks, potentially disrupting network operations or compromising network security. However, there are no reports of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates and consider network-level controls to limit exposure from adjacent IPv4 networks if feasible.