CVE-2026-102726Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read

Description

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure-Nak without validating each option's length. A malicious PPP peer can stall the PPP thread indefinitely with a zero-length option, taking the link down, and can read back up to four bytes of packet-buffer memory per exchange with a short address option.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-2wwp-ffgp-6ggj