CVE-2026-102715

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for a longer stored one. A host on the local link can send two mDNS records that make a device performing continuous service discovery write up to three bytes past its transmit packet, corrupting a neighbouring packet or the pool's free list, and misattribute discovered records.

• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-2gf7-5224-5vrj