CVE-2026-102718Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length

Description

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the request without checking it against the bytes present, and reads past the end of the packet buffer. A remote, unauthenticated attacker can send a crafted SNMP request that makes the agent read adjacent memory into its OID state, faulting the agent on targets with memory protection.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-7qmm-29vg-7hf8