In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the
received datagram.
Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229,
1521, 1984). When the opcode is NX_TFTP_CODE_ERROR the message string is copied with a loop whose
only limits are the destination buffer and a NUL byte:
```c
/* addons/tftp/nxd_tftp_client.c:1769 */
for (i = 0; (i < (sizeof(tftp_client_ptr -> nx_tftp_client_error_string) - 1)) && (*buffer_ptr); i++)
```
Nothing compares `buffer_ptr` against `nx_packet_append_ptr`. An ERROR packet that carries no
terminating NUL, which a server controls completely, walks the loop off the end of the packet until
it happens to meet a zero byte or fills the 64 byte destination.
```
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1 at 0x60d0000000c8 thread T4
#0 _nxd_tftp_client_file_read addons/tftp/nxd_tftp_client.c:1769
0x60d0000000c8 is 0 bytes to the right of 136-byte region
```
The open path has the same loop at :1327 and reports the same way. What is read lands in
`nx_tftp_client_error_string`, which the application is expected to display or log, so adjacent
packet pool memory ends up in whatever the device does with the error text.
Add `(buffer_ptr < packet_ptr -> nx_packet_append_ptr)` to the loop condition in all three paths.
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a
kilobyte past the end of the received message.
The option walk keeps a pointer and an offset in step, and the only bound check uses the offset:
```c
/* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */
while (i < length - 1)
{
...
size = *(++data); /* data moves 1: type -> length byte */
data += size + 1; /* data moves size + 1 more */
i += size + 1; /* i moves only size + 1 */
}
```
A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so
the offset falls one byte behind the real read position for every option the walk skips. After
enough skipped options the check `i < length - 1` still holds while `data` is already past the end
of the message, and the subsequent read of the type and length bytes comes from whatever follows.
A single OFFER carrying a long run of skippable options is enough:
```
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1 at 0x61b000000794 thread T5
#0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7541
#1 _nx_dhcp_get_option_value addons/dhcp/nxd_dhcp_client.c:7082
0x61b000000794 is located 164 bytes to the right of 1648-byte region
```
A well formed OFFER through the same path is handled normally, the client records the offer and
moves to REQUESTING, so the difference is the option layout rather than the harness.
The read runs in the DHCP client thread while the client is still unconfigured, so it happens on
every boot in reach of a hostile DHCP responder. The values read are used to configure the
interface, which is how the disclosed bytes become observable.
Advance `i` by size + 2, or derive the bound from `data` rather than keeping a second counter.
hey,
`_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. the OOB bytes are decoded as OID component values and written into the agents internal OID string buffer, corrupting agent state. on systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. on bare metal embedded systems without memory protection the read silently succeeds and corrupts the agents internal state with heap data.
An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests
that carry a Session header the parser cannot convert.
The Session branch returns the raw NetX error code instead of an RTSP status code:
```c
/* addons/rtsp/nx_rtsp_server.c:2754 */
status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id);
if (status)
{
return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */
}
```
Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch
eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The
raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not
recognise it, takes a path that returns without releasing the response packet it already allocated,
and the block never goes back to the pool.
Six requests with an empty Session header against a 22 packet pool:
```
valid requests: after request 6: pool available = 21, AFTER = 22 / 22
malformed requests: after request 6: pool available = 16, AFTER = 17 / 22
```
One block per request, not returned when the client disconnects. Twenty six requests take the pool
to zero and the server starts failing allocations, after which it serves nobody. If the pool is
shared with the rest of the application, as it is in the shipped sample, the rest of the stack
stops with it.
Convert the `_nx_utility_string_to_uint` failure in the Session branch into
NX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on
every exit path of `_nx_rtsp_server_error_response_send`.
Any host on the LAN can send two mDNS records and make the responder write past the end of its
transmit packet.
The string table stores each name in a slot rounded up to a multiple of four:
```c
/* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */
memory_len = ((memory_len & 0xFFFFFFFC) + 8) & 0xFFFFFFFF;
...
len = *((USHORT*)(p - 2)); /* slot size, not string length */
if ((len == memory_len) && ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...)
```
The lookup that decides whether an incoming name is already stored compares the rounded slot size,
so names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered
with the pointer to the first, and the record then carries a string up to three bytes longer than
the length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only
bound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string.
Two PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names
whose lengths fall in the same bucket:
```
==87491==ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1 at 0x611000000124 thread T5
#0 _nx_mdns_name_string_encode addons/mdns/nxd_mdns.c:13096
#1 _nx_mdns_packet_rr_add addons/mdns/nxd_mdns.c:8911
0x611000000124 is 0 bytes to the right of 228-byte region
```
The overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a
normal pool that lands in the next packet in the same pool rather than in a redzone, so the visible
effect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash.
Compare the slot size against the stored string length before declaring a match, or keep the
string length in the slot header and return it to the caller so the encoder and the bound check
agree.
`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns `NX_SUCCESS`. Its zero-length rejection never sees those bytes.
Every consumer then re-walks the same area, reading a two-byte option header at the residue and subtracting `nx_icmpv6_option_length << 3` with no zero check and no remaining-length check. Three outcomes follow, selected by bytes the attacker controls.
**Zero length byte.** The walker subtracts zero and advances zero. All four handlers loop forever — `_nx_icmpv6_process_ra` (`nx_icmpv6_process_ra.c:245, :528`), `_nx_icmpv6_process_ns` (`:251, :329`), `_nx_icmpv6_process_na` (`:147, :156`) and `_nx_icmpv6_process_redirect` (`:247, :350`). The walk runs in the IP thread, which is the highest-priority thread and does not yield inside the loop, so the system stops until a watchdog reset and the frame can be replayed after each one.
**Non-zero length byte on a short residue.** The three unsigned counters underflow — `2 - 8` becomes `0xFFFFFFFA` — and the walk continues past the packet buffer, reading until it faults or meets a zero length byte and freezes. The Router Advertisement counter is signed and exits cleanly in this case.
**One-byte residue.** The walker reads a two-byte option header, over-reading one byte.
During a runaway walk, stray bytes parsing as a link-layer address option are copied into the neighbor cache (`nx_icmpv6_process_ns.c:280, :293`) and subsequently used as the destination MAC for frames to that neighbour, placing off-packet memory on the link. Confirmed by inspection, not reproduced.
CVE-2026-102713 is a high-severity vulnerability in the Eclipse Foundation NetX Duo TFTP server. It involves an out-of-bounds read caused by the server accepting DATA datagrams of any size without enforcing an upper bound check. This flaw leads to memory disclosure and can cause the server to become unresponsive. The vulnerability affects versions up to and including 6.5.1.202602.
CVE-2026-102712 is a high-severity out-of-bounds read vulnerability in Eclipse Foundation's NetX Duo library. It occurs during the parsing of the first DTLS ClientHello message, where the parser incorrectly validates the ciphersuite-list length against the total record length rather than the remaining bytes. This flaw allows an unauthenticated attacker to read up to 255 bytes of adjacent process memory and leak it in the ServerHello response. The vulnerability can also cause a crash on the first packet received.
CVE-2026-102711 is a medium severity vulnerability in the Eclipse Foundation's ThreadX loadable-module loader. It involves two issues triggered when loading an attacker-controlled module via APIs that trust size and offset fields without validation. The first issue is a heap out-of-bounds read due to trusting the code size as the source image length during copying. The second issue is a control-flow integrity gap where module function pointers are computed without proper checksum verification or thorough validation. No out-of-bounds write was found.
CVE-2026-102710 is a critical improper privilege management vulnerability in Eclipse Foundation's eclipse-threadx/threadx. A user-mode, memory-protected module can register an arbitrary function pointer as a global trace callback, which the kernel calls directly without validation. This can lead to kernel faults (DoS) or execution of code with kernel privileges.
CVE-2026-102709 is a high-severity vulnerability in Eclipse Foundation's ThreadX affecting versions up to 6.5.1.202602. It involves improper validation of non-secure pointers in TrustZone-M non-secure callable entry functions, allowing an attacker in the non-secure world to cause the secure firmware to disclose secure memory contents. This breaks the isolation guarantees of Arm TrustZone-M and could lead to exposure of sensitive cryptographic material.
CVE-2026-102762 is a high-severity vulnerability in the Eclipse Foundation's NetX Duo MQTT client. It causes a memory leak by failing to release packets carrying malformed PUBLISH messages. Each malformed message consumes resources from the network driver's receive pool without returning them, potentially exhausting the pool. This exhaustion halts all inbound network traffic on the affected device until it is rebooted.
CVE-2026-102761 is a critical out-of-bounds write vulnerability in the Eclipse Foundation's NetX Duo WebSocket client. The flaw arises because the unmasking cursor resets incorrectly when processing chained packets, causing an XOR loop to write attacker-controlled data beyond intended memory boundaries. This vulnerability affects versions 6.2.0 through 6.5.1.202602 of NetX Duo.
CVE-2026-102760 is a use-after-free vulnerability in Eclipse Foundation's NetX Duo when built with NX_SECURE_KEY_CLEAR. The vulnerability occurs because TLS records are wiped after being handed to TCP, which may have already released the packet memory. This leads to memory corruption by writing zeros into freed or reused packets, causing an underflow and out-of-bounds memory write.
CVE-2026-102759 is a medium severity vulnerability in Eclipse Foundation's NetX Duo where the NetX Secure TLS component improperly validates the integrity check value. Specifically, it accepts an empty TLS application-data record without verifying its message authentication code (MAC), treating such records as valid and advancing the receive sequence number without MAC comparison. Empty TLS application-data records are legal and commonly used in TLS 1.0 as a mitigation against the BEAST attack.
CVE-2026-102758 is a buffer over-read vulnerability in the Eclipse Foundation NetX Duo library's function _nx_secure_x509_asn1_tlv_block_parse(). This function reads an ASN.1 tag byte from a buffer before verifying the buffer length, potentially reading one byte beyond the buffer when the remaining length is zero. The vulnerability affects X.509 certificate parsing during TLS handshakes. The issue can cause an out-of-bounds read but does not impact confidentiality or integrity, only availability. The affected versions are from 0 up to and including 6.5.1.202602.
CVE-2026-102757 is a high-severity vulnerability in the Eclipse Foundation's ThreadX real-time operating system. It allows an unprivileged, memory-protected module to manipulate kernel memory in privileged mode, bypassing isolation boundaries by clearing the MPU enable bit. This occurs due to improper validation in the Module Manager's object dereference logic, enabling an attacker to craft addresses that pass checks incorrectly and gain privileged memory access.