CVE-2026-103416: Critical severity Eclipse threadx NetX Duo vulnerability
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
TLS 1.3 clients using Eclipse ThreadX NetX Duo are exposed when they connect to a malicious or compromised server capable of sending crafted handshake data.
Does exploitation require a trusted or valid server certificate?
No. The vulnerable processing occurs before certificate authentication completes, so the server does not need a certificate to reach the affected code path.
What does the attacker need to send?
The attacker needs to provide a TLS 1.3 handshake message larger than the handshake message cache, causing a write beyond that cache into the session control block.