NULL pointer dereference in NetX Duo - CVE-2026-114408
Published: November 9, 2026
Vulnerability identifier: #VU162969
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114408
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to crash the NetX Duo IP helper thread, causing denial of service.
The vulnerability exists due to an unchecked destination-table insertion failure in ICMPv6 Packet Too Big processing when the table is full, in builds with IPv6 and non-default path MTU discovery enabled. An unauthenticated remote attacker can send messages quoting distinct destinations to fill the table, then trigger a NULL pointer dereference with another message.
Affected software
NetX Duo
How to mitigate CVE-2026-114408
Install security update from vendor's website.
NetX Duo - update to 6.5.2.202603