PT-2026-50864 · Eclipse Foundation · Eclipse Threadx Netx Duo

Decsecre583 · Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-11576

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx file close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx file close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

Fix

Use of Uninitialized Resource

Double Free

Weakness Enumeration

CWE-908

CWE-415

CWE-459

Related Identifiers

CVE-2026-11576

Affected Products

Eclipse Threadx Netx Duo

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-11576 · Security Note
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/123 · Note