Review reviewHigh

CVE-2026-11576

Eclipse Foundation Eclipse ThreadX - NetX Duo, threadx netx duo

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

CVSS: 7.5
EPSS: 0.46%
CISA KEV: Not listed
Published: 2026.06.19

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.46%

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: Eclipse Foundation Eclipse ThreadX - NetX Duo, threadx netx duo
Affected versions: 6.4.2, >= 6.4.2 <= 6.5.0.202601
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Eclipse Foundation Eclipse ThreadX - NetX Duo, threadx netx duo and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-415, CWE-459, CWE-908