{"id":"CVE-2026-92843","kind":"vulnerability","aliases":["CVE-2026-92843"],"related":[],"title":"NetX Secure: TLS 1.3 Certificate parser reads heap memory out of bounds","description":"A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.","summary":"NetX Secure's TLS 1.3 Certificate parser reads the per-certificate extensions_length unchecked; if it exceeds the remaining list, total_length underflows and the parser reads up to ~64 KiB past the buffer, pre-authentication, reachable by a rogue server, on-path attacker or rogue AP. Vendor-confirmed impact is a silent over-read or fault (DoS); bytes go to the DER parser, not back to the attacker. The same underflow could make the bad cert_length a copy size (possible out-of-bounds write); the vendor has not confirmed this. No known exploitation or public PoC.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetX Duo (Eclipse ThreadX)","fixed":["6.5.2.202603"],"affected":"<= 6.5.1.202602","ecosystem":"vendor"}],"ecosystems":[],"tags":["azure-rtos","eclipse-threadx","embedded","infrastructure","iot","netx-duo","netx-secure","tls-1.3","tls-clients"],"not_affected_if":["no-tls-1.3-client","not-netx-secure","not-using-netx-secure","tls-1.3-disabled"],"how_to_check":"Affected if firmware uses Eclipse ThreadX NetX Duo <= 6.5.1.202602 built with NX_SECURE_TLS_TLS_1_3_ENABLED, as a client or as a server that verifies client certificates. Check the NetX Duo version in your source tree/SDK; in _nx_secure_tls_process_remote_certificate, the vulnerable code adds extensions_length to the cursor with no bounds checks.","fix":"Upgrade NetX Duo to 6.5.2.202603, then rebuild and reflash. Only workaround: build without TLS 1.3 (NX_SECURE_TLS_ENABLE_TLS_1_3). No mitigation inside a TLS 1.3 build.","status":"open","published_at":"2026-10-20T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:37:21+00:00","updated_at":"2026-10-24T00:13:47+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:37:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NetX Secure: TLS 1.3 Certificate parser reads heap memory out of bounds","impact":"medium","summary":"A missing bounds check in NetX Secure's TLS 1.3 Certificate message parser causes an unsigned integer underflow and a heap out-of-bounds read. A malicious TLS 1.3 server can trigger it during the handshake, before certificate verification finishes.","category":"infrastructure","who_cares":["netx-secure","embedded","tls-clients","azure-rtos"],"confidence":0.5,"needs_auth":"no","worst_case":"heap memory read out of bounds; code execution not stated by sources","analyst_note":"Check NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-92843) and the vendor advisory for affected versions, a fixed release, and whether the flaw can lead beyond an out-of-bounds read.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-tls-1.3-client","not-using-netx-secure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0005,"input_tokens":2943,"output_tokens":412,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-92843) and the vendor advisory for affected versions, a fixed release, and whether the flaw can lead beyond an out-of-bounds read.","search":"'-1.3':39B '-2026':14A,17A '-92843':15A,18A '1.3':4A,47B,154C,166C '64':73B 'ap':92B 'attack':89B,116B 'authent':80B,197C 'azur':24B 'azure-rto':23B 'back':113B 'bad':123B 'bound':12A,133B,149C,181C 'buffer':77B 'byte':106B 'cert':124B 'certif':5A,48B,54B,156C,190C,203C 'certificate-messag':155C 'check':150C 'client':42B 'complet':205C 'confirm':95B,139B 'copi':127B 'could':120B 'cve':13A,16A 'der':110B 'dos':105B 'duo':20A,34B 'eclips':27B 'eclipse':21A 'eclipse-threadx':26B 'embed':29B 'exceed':60B 'exploit':143B 'extens':55B 'fault':104B 'go':107B 'handshak':201C 'heap':8A,177C 'impact':96B 'infrastructur':30B 'integ':172C 'iot':31B 'kib':74B 'known':142B 'length':56B,65B,125B 'let':162C 'list':63B 'make':121B 'malici':164C 'memori':9A 'messag':157C,191C 'miss':148C 'netx':1A,19A,33B,36B,43B,160C 'netx-duo':32B 'netx-secur':35B 'normal':200C 'on-path':86B 'out-of-bound':130B,178C 'over-read':100B 'parser':6A,49B,69B,111B,158C 'past':75B 'path':88B 'peer':185C 'per':53B 'per-certif':52B 'poc':146B 'possibl':129B 'pre':79B,196C 'pre-authent':78B,195C 'process':187C 'public':145B 'reachabl':81B,194C 'read':7A,50B,70B,102B,182C 'remain':62B 'remot':189C 'rogu':84B,91B 'rtos':25B 'secur':2A,37B,44B,161C 'server':85B,167C 'silent':99B 'size':128B 'subsequ':176C 'threadx':22A,28B 'tls':3A,38B,41B,46B,153C,165C 'tls-client':40B 'total':64B 'trigger':168C 'uncheck':57B 'underflow':66B,119B,173C 'unsign':171C 'unsigned-integ':170C 'vendor':94B,136B 'vendor-confirm':93B 'verif':204C 'write':134B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92843","severity":null,"published_at":"2026-10-20T16:17:17+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92843:613","url":null,"severity":null,"published_at":"2026-10-24T00:13:47+00:00","modified_at":"2026-10-24T00:13:47+00:00","first_seen_at":"2026-10-24T00:13:47+00:00","fetched_at":"2026-10-24T00:13:47+00:00","note":"Read vendor GHSA-4m85-f9qh-q3jv (Eclipse ThreadX): extensions_length underflow (sibling of CVE-2026-92853, different bug, same fix release 6.5.2.202603). Heap OOB read up to ~64KiB, DoS; vendor flags a possible OOB write as unconfirmed. No exploitation or PoC found; social not searched."}],"documents":[{"id":2481,"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-4m85-f9qh-q3jv","title":"GHSA-4m85-f9qh-q3jv: OOB read via TLS 1.3 Certificate extensions_length in NetX Secure","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2478,"url":"https://github.com/eclipse-threadx/netxduo/releases","title":"eclipse-threadx/netxduo releases (6.5.2.202603)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}