CVE-2026-93475
9.3CriticalPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-787, CWE-1284
Impact
Remote, unauthenticated attackers can execute arbitrary code or crash devices handling TLS/DTLS traffic. They only need network connectivity to present a crafted certificate chain during standard TLS handshakes.
Root cause
The X.509 parser accepts arbitrary RSA key sizes but decrypts signatures into fixed-size buffers sized for NX_CRYPTO_MAX_RSA_MODULUS_SIZE, causing an out-of-bounds write when verifying keys larger than 4096 bits.
Affected systems
NetX Secure (Eclipse ThreadX netxduo); exact version ranges not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade to the patched netxduo release referenced in advisory GHSA-rcv5-vfff-25gh; if patching cannot be done immediately, disable client-certificate authentication on exposed TLS/DTLS servers and avoid connecting TLS/DTLS clients to untrusted endpoints.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.