Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-93475: NetX Secure X.509 parser overwrites memory with large key
CVE-2026-93475 · published 2 days ago
Summary
The X.509 certificate handling in NetX Secure (ThreadX NetX Duo) accepts RSA public keys of any size, but its internal buffers are only sized for keys up to 4096 bits. A malicious certificate with a larger key can cause the software to write beyond the buffer, potentially leading to crashes or code execution. Apply the vendor's security update or limit accepted certificate sizes until the fix is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eclipse foundation | eclipse threadx - netx duo | <= 6.5.1.202602 |
Original advisory text
Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification.
It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.
It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.9
Critical
Type
CWE-787Out-of-bounds Write
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published20 Oct 2026
Updated22 Oct 2026
First seen20 Oct 2026
Track software like this
Free during beta