CVE-2026-102728: Microsoft NetX Secure vulnerability
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
TLS or DTLS clients using the affected NetX Secure handshake parsers are exposed when they connect to a malicious or malformed server. The vulnerable code is on a remotely reachable client-side path.
What does an attacker need to exploit the flaw?
An attacker needs to act as, or control, a TLS or DTLS server that the client connects to and send a handshake message that is shorter than required for fields the parser reads.