CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-11576

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 17.7%

CVSS Severity

CVSS v3 Score 7.5

References

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/123

Products affected by CVE-2026-11576

Eclipse » Threadx Netx Duo » Version: 6.4.2

cpe:2.3:a:eclipse:threadx_netx_duo:6.4.2
Eclipse » Threadx Netx Duo » Version: 6.4.3

cpe:2.3:a:eclipse:threadx_netx_duo:6.4.3
Eclipse » Threadx Netx Duo » Version: 6.4.4.202503

cpe:2.3:a:eclipse:threadx_netx_duo:6.4.4.202503
Eclipse » Threadx Netx Duo » Version: 6.4.4.202503a

cpe:2.3:a:eclipse:threadx_netx_duo:6.4.4.202503a

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-11576

Products

Pricing

Contact Us