Live › vulnerability › CVE-2026-93475
Go to dashboardNetX Secure (Eclipse ThreadX NetX Duo) X.509 parsing accepts RSA moduli up to 64 KiB, but certificate verification decrypts into a fixed 512-byte static buffer sized for 4096 bits. A peer sends an oversized-key intermediate certificate in its own chain, which gives an attacker-influenced out-of-bounds write before authentication. It affects TLS/DTLS clients and servers that use client-certificate authentication. No exploitation path has been developed or published yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NetX Duo | vendor | <= 6.5.1.202602 | 6.5.2.202603 |
6.5.1.202602 or older6.5.2.202603 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the NX_CRYPTO_MAX_RSA_MODULUS_SIZE default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification.
It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-93475")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.