by Kastro
Paper/Archive/CVE-2026-103416

CVE-2026-103416

Eclipse Foundation Eclipse ThreadX - NetX Duo — Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake messa…

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
30
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 11.1.111 × 202.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.

Affected

ProductAffectedFixed inSource
Eclipse ThreadX - NetX Duo≤ 6.5.1.2026026.5.2.202603CNA

Scores by source

eclipse (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgitlab.eclipse.org/security/cve-assignment/-/work_items/356refgithub.com/eclipse-threadx/netxduo/security/advisories/GHSA-4x76-j955-qhq2