CVE-2026-11576 Memory corruption in Eclipse ThreadX - NetX Duo

What is CVE-2026-11576?

CVE-2026-11576 is a high-severity memory corruption vulnerability in Eclipse ThreadX - NetX Duo, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

Weakness: CWE-908, CWE-459, CWE-415

Which versions are affected by CVE-2026-11576?

It affects 1 product.

Products include Eclipse Threadx Netx Duo.

How do I fix CVE-2026-11576?

No fix has been published for CVE-2026-11576 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-11576 being exploited?

There is no known exploitation of CVE-2026-11576 in the wild and no public exploit code.

Other vulnerabilities in Eclipse ThreadX - NetX Duo

• CVE-2025-55085 Web http client: Unchecked Server-Side Malicious Packet Issue High 8.8
• CVE-2025-55102 Denial of service in Eclipse ThreadX - NetX Duo High 8.7
• CVE-2025-2260 Eclipse ThreadX NetX Duo HTTP component server denial of service High 7.1
• CVE-2025-0726 Eclipse ThreadX NetX Duo HTTP server denial of service High 7.1
• CVE-2024-2452 Integer wraparound, under-allocation, and heap buffer overflow in Eclipse ThreadX NetX Duo __portable_aligned_alloc() High 7.0

Sources

• CVE record
• NVD
• OSV
• How this page is made