CVE-2024-2452: High Integer Wraparound in Eclipse ThreadX NetX Duo

CVE-2024-2452 is a high severity (CVSS 7.0) integer wraparound in the Eclipse ThreadX NetX Duo network stack before 6.4.0. If an attacker controls the inputs to one allocation function, a smaller buffer is returned and heap overflow can follow. Upgrade to 6.4.0 or later.

What's affected

Eclipse ThreadX NetX Duo versions before 6.4.0. The GitHub security advisory GHSA-h963-7vhw-8rpx confirms 6.4.0 as the fixed version and says the vulnerable code has been removed. It lists no workarounds for earlier versions.

Severity matches across the sources: the NVD record and the advisory both give 7.0, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L. Note the high attack complexity in that vector.

The issue sits in __portable_aligned_alloc(). The condition in the record is that an attacker must be able to control its parameters.

How to check if you're exposed

NetX Duo is usually compiled into device firmware, so the library version is hidden inside the product. Look in your source tree or SBOM for the NetX Duo component and read its version. If you ship devices from a vendor, ask them for the NetX Duo version in each firmware release.

Also search your code for calls to the aligned allocation function, and look at where its size and alignment arguments come from. If they cannot be influenced by network input, the practical risk drops, though you should still update.

What to do now

1. Identify every product or firmware image that includes NetX Duo.
2. Move to NetX Duo 6.4.0 or later and rebuild.
3. Ask device vendors for firmware that includes the fixed library.
4. Review any code that passes external values into allocation size or alignment.
5. Keep an SBOM per firmware release so the next library flaw is a lookup, not a hunt.

Why it matters

The record lists CWE-120, a buffer copy without checking size, and CWE-190, integer overflow or wraparound. The advisory describes a calculation that wraps around, so the allocator hands back less memory than the caller asked for. Later writes then run past the end of the buffer.

Embedded networking code is hard to patch because the library ships inside someone else's product. A flaw in a widely reused stack reaches many devices, and each vendor has to rebuild and release firmware.

This CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not say it was exploited.

Try it yourself

Click through it at your own pace, or open it full screen.

Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages a project pulls in.

Quick check

Sources

• GitHub advisory GHSA-h963-7vhw-8rpx
• NVD record for CVE-2024-2452

Last reviewed: 19 October 2026.