CVE-2026-102728

Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS client's HelloVerifyRequest parser read fields before checking that the message is long enough to contain them. A malicious server or an on-path attacker can make the client read up to three bytes past a handshake message, which can fault the client on targets with memory protection.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard. In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS client's HelloVerifyRequest parser read fields before checking that the message is long enough to contain them. A malicious server or an on-path attacker can make the client read up to three bytes past a handshake message, which can fault the client on targets with memory protection.
Title Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}
Type Values Removed Values Added
Title Out-of-Bounds Read in NetX Duo TLS/DTLS Handshake Parsers
Type Values Removed Values Added
First Time appeared Eclipse
Eclipse netx Duo
Vendors & Products Eclipse
Eclipse netx Duo
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Out-of-Bounds Read in NetX Duo TLS/DTLS Handshake Parsers
Type Values Removed Values Added
Description Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
Weaknesses CWE-126
References
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
eclipse
Published
Updated
Nov 4, 2026, 10:45 AM
Reserved
Sep 29, 2026, 4:15 PM

View source JSON

Updated
Sep 30, 2026, 7:35 PM

JSON

Status
Awaiting Analysis
Published
Sep 29, 2026, 6:17 PM
Modified
Nov 4, 2026, 11:17 AM

View source JSON

No data.

Updated
Nov 4, 2026, 2:30 PM

JSON