CVE-2025-55085: eclipse foundation netx duo Out-of-bounds Read
CVSS: 8.8v4.0HighAnalyzed
Published 17-10-2025Last modified 20-10-2025
Vulnerability summary
CVE-2025-55085 is a high (CVSS 8.8) Out-of-bounds Read vulnerability in eclipse foundation netx duo. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v4.0 (CVE.org)EPSS score
0.61%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 17-10-2025PublishedVulnerability first disclosed.
- 20-10-2025Last modifiedVulnerability information updated.
Description
In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 8.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
+0.01 pp
From 0.61% on 19-09-2026
19-09-202619-10-2026
EPSS score0.61%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNetxduo
Maturity: poc
Weaknesses
CWE · root cause- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-1286Improper Validation of Syntactic Correctness of InputThe product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Affected systems
Eclipse1 product
- threadx_netx_duo< 6.4.4.202503
Eclipse foundation1 product
- netx duo< 6.4.4
2 vendors · 2 products