CVE-2026-103415
9.3CriticalPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-787
Impact
A malicious or compromised TLS server can overwrite client memory out-of-bounds, potentially leading to remote code execution. The attacker only needs the client to initiate a TLS connection to them, and exploitation occurs before certificate verification.
Root cause
The TLS 1.3 client handler blindly copies the server-supplied cookie from a HelloRetryRequest into the subsequent ClientHello packet without verifying it fits in the destination buffer.
Affected systems
Eclipse ThreadX NetX Duo (client path); exact version ranges are not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade NetX Duo to the patched release referenced in advisory GHSA-5pv3-rhf5-gwgq once available. If immediate upgrading is not possible, restrict outbound TLS 1.3 connections from affected embedded devices or avoid connecting to untrusted endpoints.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected.