Is CVE-2026-114408 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114408 being exploited in the wild.

How severe is CVE-2026-114408?

Informational severity, published 2 November 2026.

Which products and versions are affected?

Eclipse ThreadX NetX Duo 6.4.5.202504 through 6.5.2.202603a (when built with NX_ENABLE_IPV6_PATH_MTU_DISCOVERY).

How is CVE-2026-114408 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114408?

Check whether you run Eclipse ThreadX NetX Duo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114408: Eclipse ThreadX NetX Duo NULL pointer dereference in ICMPv6 path MTU discovery

CVE-2026-114408 · Severity: info · Published 2026-11-02

Eclipse ThreadX NetX Duo is a real-time network stack for embedded systems that handles IPv6 network traffic. When IPv6 path MTU discovery is enabled, an attacker can send specially crafted ICMPv6 messages to fill the destination table, causing a NULL pointer dereference in the IP helper thread that crashes network processing and stops all network communication on the device.

Technologies: Eclipse ThreadX NetX Duo. Vendors: Eclipse ThreadX.

Quick answers

Is CVE-2026-114408 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114408 being exploited in the wild.
How severe is CVE-2026-114408?: Informational severity, published 2 November 2026.
Which products and versions are affected?: Eclipse ThreadX NetX Duo 6.4.5.202504 through 6.5.2.202603a (when built with NX_ENABLE_IPV6_PATH_MTU_DISCOVERY).
Is there a fix for CVE-2026-114408?: Yes: fixed in NetX Duo 6.5.2.202603b. Until then: Disable IPv6 path MTU discovery by building without NX_ENABLE_IPV6_PATH_MTU_DISCOVERY, or increase NX_IPV6_DESTINATION_TABLE_SIZE to raise the threshold of messages needed to trigger the crash (though this does not remove the defect). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114408 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114408?: Check whether you run Eclipse ThreadX NetX Duo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: NetX Duo 6.5.2.202603b

Disable IPv6 path MTU discovery by building without NX_ENABLE_IPV6_PATH_MTU_DISCOVERY, or increase NX_IPV6_DESTINATION_TABLE_SIZE to raise the threshold of messages needed to trigger the crash (though this does not remove the defect).

Technical details

The ICMPv6 Packet Too Big handler in _nx_icmpv6_process_packet_too_big calls _nx_icmpv6_dest_table_add without checking whether the add succeeded before dereferencing the returned entry pointer. When the destination table is full (8 entries by default), the add returns NULL, and the next dereference causes a segmentation fault in the IP helper thread. An unauthenticated attacker on the network can trigger this by sending ICMPv6 Packet Too Big messages with distinct destination addresses, requiring no source address validation or privilege.

Affected products

Eclipse ThreadX NetX Duo 6.4.5.202504 through 6.5.2.202603a (when built with NX_ENABLE_IPV6_PATH_MTU_DISCOVERY)

Timeline

2026-11-02: disclosed
2026-11-02: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.