---
id: "CVE-2026-92843"
kind: "vulnerability"
aliases: ["CVE-2026-92843"]
title: "NetX Secure: TLS 1.3 Certificate parser reads heap memory out of bounds"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NetX Duo (Eclipse ThreadX)", "fixed": ["6.5.2.202603"], "affected": "<= 6.5.1.202602", "ecosystem": "vendor"}]
ecosystems: []
tags: ["azure-rtos", "eclipse-threadx", "embedded", "infrastructure", "iot", "netx-duo", "netx-secure", "tls-1.3", "tls-clients"]
not_affected_if: ["no-tls-1.3-client", "not-netx-secure", "not-using-netx-secure", "tls-1.3-disabled"]
published_at: "2026-10-20T16:17:17+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-24T00:13:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92843", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:13:47+00:00"}]
---

# NetX Secure: TLS 1.3 Certificate parser reads heap memory out of bounds

NetX Secure's TLS 1.3 Certificate parser reads the per-certificate extensions_length unchecked; if it exceeds the remaining list, total_length underflows and the parser reads up to ~64 KiB past the buffer, pre-authentication, reachable by a rogue server, on-path attacker or rogue AP. Vendor-confirmed impact is a silent over-read or fault (DoS); bytes go to the DER parser, not back to the attacker. The same underflow could make the bad cert_length a copy size (possible out-of-bounds write); the vendor has not confirmed this. No known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetX Duo (Eclipse ThreadX) affected <= 6.5.1.202602 fixed 6.5.2.202603

## How to check

Affected if firmware uses Eclipse ThreadX NetX Duo <= 6.5.1.202602 built with NX_SECURE_TLS_TLS_1_3_ENABLED, as a client or as a server that verifies client certificates. Check the NetX Duo version in your source tree/SDK; in _nx_secure_tls_process_remote_certificate, the vulnerable code adds extensions_length to the cursor with no bounds checks.

## Fix

Upgrade NetX Duo to 6.5.2.202603, then rebuild and reflash. Only workaround: build without TLS 1.3 (NX_SECURE_TLS_ENABLE_TLS_1_3). No mitigation inside a TLS 1.3 build.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92843
- 2026-10-24T00:13:47+00:00 analyst — Read vendor GHSA-4m85-f9qh-q3jv (Eclipse ThreadX): extensions_length underflow (sibling of CVE-2026-92853, different bug, same fix release 6.5.2.202603). Heap OOB read up to ~64KiB, DoS; vendor flags a possible OOB write as unconfirmed. No exploitation or PoC found; social not searched.

## Documents

- [advisory] GHSA-4m85-f9qh-q3jv: OOB read via TLS 1.3 Certificate extensions_length in NetX Secure https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-4m85-f9qh-q3jv
- [fix] eclipse-threadx/netxduo releases (6.5.2.202603) https://github.com/eclipse-threadx/netxduo/releases

## From the sources

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_