{"id":"CVE-2026-93475","kind":"vulnerability","aliases":["CVE-2026-93475"],"related":[],"title":"NetX Secure: oversized RSA certificate key overflows a static buffer","description":"The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification.\n\n\n\nIt is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.","summary":"NetX Secure (Eclipse ThreadX NetX Duo) X.509 parsing accepts RSA moduli up to 64 KiB, but certificate verification decrypts into a fixed 512-byte static buffer sized for 4096 bits. A peer sends an oversized-key intermediate certificate in its own chain, which gives an attacker-influenced out-of-bounds write before authentication. It affects TLS/DTLS clients and servers that use client-certificate authentication. No exploitation path has been developed or published yet.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetX Duo","fixed":["6.5.2.202603"],"affected":"<= 6.5.1.202602","ecosystem":"vendor"}],"ecosystems":[],"tags":["client-certificate-auth","dtls","embedded","netx-duo","netx-secure","other","runtime","threadx","tls-clients","tls-servers"],"not_affected_if":["default-config"],"how_to_check":"Check your NetX Duo version: it is vulnerable if it is 6.5.1.202602 or older. Any build that verifies a peer certificate chain is affected (TLS/DTLS client, or server with client-cert auth). No build option avoids the path.","fix":"Upgrade NetX Duo to 6.5.2.202603 or later. The parser now rejects RSA moduli larger than NX_CRYPTO_MAX_RSA_MODULUS_SIZE, and _nx_crypto_method_rsa_init refuses them too. There is no workaround; disabling chain verification is not a mitigation.","status":"open","published_at":"2026-10-20T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:26+00:00","updated_at":"2026-10-23T23:19:09+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-10-23T22:39:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NetX Secure: oversized RSA certificate key overflows a static buffer","impact":"high","summary":"The X.509 parser in NetX Secure accepts RSA public keys larger than 4096 bits, but signature checks decrypt into 4096-bit buffers. A crafted certificate chain writes past a static buffer during normal verification, before any login.","category":"runtime","who_cares":["netx-secure","embedded","tls-clients","tls-servers"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker overwrites memory during certificate verification, possibly running code","analyst_note":"Confirm affected NetX Secure versions and the patched release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-93475) and the vendor advisory; check whether the RSA modulus limit can be raised at build time as a mitigation.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000505,"input_tokens":3099,"output_tokens":390,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected NetX Secure versions and the patched release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-93475) and the vendor advisory; check whether the RSA modulus limit can be raised at build time as a mitigation.","search":"'-2026':12A,15A '-93475':13A,16A '4096':68B,154C '512':62B '64':53B 'accept':48B,123C 'affect':97B 'attack':87B,210C 'attacker-influenc':86B 'auth':22B 'authent':95B,107B,186C,246C 'bit':69B,155C 'bound':92B,167C 'buffer':10A,65B,142C 'byte':63B 'carri':158C 'certif':5A,21B,56B,78B,106B,157C,178C,245C 'certificate-chain':177C 'chain':82B,179C,221C,237C 'client':20B,36B,99B,105B,231C,244C 'client-certif':104B,243C 'client-certificate-auth':19B 'crypto':147C,192C 'cve':11A,14A 'decrypt':58B,137C 'default':152C 'develop':113B 'dimens':143C 'drive':162C 'dtls':23B,230C 'duo':18A,27B,45B 'eclips':42B 'embed':24B 'everi':132C 'exploit':109B 'file':172C 'file-scop':171C 'fix':61B,140C 'fixed-s':139C 'give':84B 'influenc':88B 'intermedi':77B,218C 'issuer':188C 'key':6A,76B,127C,214C 'kib':54B 'larger':160C 'look':195C 'malici':234C 'max':148C 'moduli':50B 'modulus':150C,161C 'netx':1A,17A,26B,29B,40B,44B,121C 'netx-duo':25B 'netx-secur':28B 'nx':146C 'oper':193C 'ordinari':176C 'out-of-bound':89B,164C 'overflow':7A 'overs':3A,75B,213C 'oversized-key':74B 'pars':47B 'parser':119C 'past':169C 'path':110B,136C 'peer':71B,201C 'peer-suppli':200C 'perform':242C 'pre':185C 'pre-authent':184C 'present':223C 'public':126C 'publish':115B 'reachabl':183C 'remot':199C 'rsa':4A,49B,125C,149C 'runtim':32B 'scope':173C 'secur':2A,30B,41B,122C 'send':72B 'server':39B,101B,235C,241C 'signatur':134C 'signature-verif':133C 'size':66B,130C,141C,151C 'static':9A,64B,174C 'store':203C,207C 'suppli':202C,211C 'threadx':33B,43B 'tls':35B,38B,228C 'tls-client':34B 'tls-server':37B 'tls/dtls':98B 'trigger':225C 'trust':206C 'use':103B,189C 'verif':57B,135C,180C 'verifi':232C 'write':93B,168C 'x.509':46B,118C 'yet':116B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93475","severity":null,"published_at":"2026-10-20T16:17:17+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93475:416","url":null,"severity":null,"published_at":"2026-10-23T23:19:09+00:00","modified_at":"2026-10-23T23:19:09+00:00","first_seen_at":"2026-10-23T23:19:09+00:00","fetched_at":"2026-10-23T23:19:09+00:00","note":"Read the primary GHSA-rcv5-vfff-25gh (eclipse-threadx/netxduo). Affected <= 6.5.1.202602, fixed 6.5.2.202603. The advisory says there is no workaround, so the triage idea of raising the RSA modulus limit at build time is not supported: the verify buffer is a fixed 512-byte static. No PoC or exploitation reported, and no X posts. NVD page returned empty, so CVE text came from the search snippets and the GHSA."}],"documents":[{"id":1882,"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-rcv5-vfff-25gh","title":"GHSA-rcv5-vfff-25gh: Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}