CVE-2026-102715

Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores each name in a slot rounded up to a multiple of four: ```c /* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */ memory_len = ((memory_len & 0xFFFFFFFC) + 8) & 0xFFFFFFFF; ... len = *((USHORT*)(p - 2)); /* slot size, not string length */ if ((len == memory_len) && ... _nx_mdns_name_match(start, memory_ptr, memory_size) ...) ``` The lookup that decides whether an incoming name is already stored compares the rounded slot size, so names of 12, 13, 14 and 15 characters share one bucket. A second name in the bucket is answered with the pointer to the first, and the record then carries a string up to three bytes longer than the length the caller accounted for. `_nx_mdns_packet_rr_add` (nxd_mdns.c:8911) sizes its only bound check from that stale length, and `_nx_mdns_name_string_encode` writes the real string. Two PTR records are enough, both ordinary mDNS responses to a `_http._tcp` query, with owner names whose lengths fall in the same bucket: ``` ==87491==ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 1 at 0x611000000124 thread T5 #0 _nx_mdns_name_string_encode addons/mdns/nxd_mdns.c:13096 #1 _nx_mdns_packet_rr_add addons/mdns/nxd_mdns.c:8911 0x611000000124 is 0 bytes to the right of 228-byte region ``` The overflow is one to three bytes of attacker-influenced name data past `nx_packet_data_end`. In a normal pool that lands in the next packet in the same pool rather than in a redzone, so the visible effect is a corrupted neighbouring packet or a corrupted pool free list rather than a clean crash. Compare the slot size against the stored string length before declaring a match, or keep the string length in the slot header and return it to the caller so the encoder and the bound check agree.

• CWE-787

• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-2gf7-5224-5vrj

Published

Sep 29, 2026

Last Modified

Sep 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10271A flaw has been found in a4m4 Student-Management-System up t…6.3
• CVE-2026-102710Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MO…9.3
• CVE-2026-102711Two issues in the ThreadX loadable-module loader, reached wh…5.7
• CVE-2026-102712On the first DTLS ClientHello, the parser copies a device-cl…8.8
• CVE-2026-102713The TFTP server accepts a DATA datagram of any size. The dis…8.8
• CVE-2026-102714`_nx_icmpv6_validate_options()` scans the option area with `…7.1
• CVE-2026-102716An unauthenticated client can drain the RTSP server's packet…8.7
• CVE-2026-102718hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNM…8.7
• CVE-2026-102719Predictable DTLS HelloVerifyRequest Cookie in NetX Secure6.3
• CVE-2026-10272A vulnerability has been found in a4m4 Student-Management-Sy…6.5
• CVE-2026-102720A DHCP server, or anyone on the LAN who answers a DISCOVER f…5.3
• CVE-2026-102721A TFTP server that answers with a short ERROR packet makes t…6.9