NetX Secure TLS 1.3 parser flaw allows pre-auth heap read
A high-severity vulnerability in NetX Secure enables remote attackers to trigger heap out-of-bounds reads during standard TLS handshakes.
Key points
- CVE-2026-92843 affects Eclipse NetX Duo versions up to 6.5.1.202602.
- The flaw allows unsigned-integer underflow via malicious TLS 1.3 servers.
- No confirmed patch or mitigation has been released by the vendor yet.
Eclipse Foundation products using NetX Duo up to version 6.5.1.202602 are affected by a high-severity vulnerability. The flaw resides in the TLS 1.3 Certificate-message parser. It allows a malicious server to trigger an unsigned-integer underflow. This leads to a heap out-of-bounds read. The issue is reachable pre-authentication. It occurs during the normal handshake process. Certificate verification has not completed when the exploit triggers.
How it unfolded
- Researchers identified a missing bounds check in the TLS 1.3 parser.
- The flaw enables unsigned-integer underflow from remote Certificate messages.
- The vulnerability was recorded as CVE-2026-92843 with a CVSS score of 8.7.
Who is affected
Organizations using Eclipse ThreadX NetX Duo up to version 6.5.1.202602 are at risk. The vulnerability is classified as HIGH severity by the National Vulnerability Database. It is associated with CWE-125, indicating a buffer over-read. The flaw is exploitable by any malicious TLS 1.3 server. It targets peers processing remote Certificate messages. The attack happens before authentication is established. This means no valid credentials are required to trigger the heap out-of-bounds read.
Our take on the response
The National Vulnerability Database lists this flaw with a CVSS score of 8.7. This high rating reflects the ease of exploitation and the lack of authentication required. The vulnerability exists in a core networking component. It affects the standard TLS handshake process. No vendor fix has been confirmed in the source material. Teams must assess their exposure to external TLS 1.3 servers. The absence of a patch increases the risk window for affected systems.
Who needs to act first
Managed service providers should prioritize systems with direct internet exposure. Check inventory for NetX Duo versions up to 6.5.1.202602. Isolate vulnerable endpoints from untrusted networks if possible. Review TLS handshake logs for anomalies. Prepare to apply updates once the vendor releases them. Test patches in staging environments before production rollout. Maintain backups of critical configurations. Monitor for any official advisories from the Eclipse Foundation regarding this vulnerability.
What to do and how to stay safe: NetX Secure
- Audit all devices running NetX Duo to identify versions up to 6.5.1.202602.
- Restrict TLS 1.3 connections from untrusted servers where business logic allows.
- Monitor network logs for unusual Certificate message patterns during handshakes.
- Prepare deployment plans for the vendor update once it becomes available.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-92843?
The CVSS score is 8.7, which is rated as HIGH severity.
Which NetX Duo versions are affected?
Versions up to 6.5.1.202602 are affected by this vulnerability.
Is authentication required to exploit this flaw?
No, the vulnerability is reachable pre-authentication during the handshake.
