CVE-2026-103415: CWE-787 Out-of-bounds Write in Eclipse Foundation NetX Duo

This vulnerability (CVE-2026-103415) in Eclipse Foundation NetX Duo affects the TLS 1.3 client implementation. When handling a HelloRetryRequest, the client copies the server's cookie into the second ClientHello message without bounds checking. Since both the length and content of the cookie come from the server and the write occurs before certificate authentication, a malicious or compromised server can trigger an out-of-bounds write, potentially leading to memory corruption. The flaw is limited to the client path and does not affect the server side.

An attacker controlling or impersonating a TLS server can exploit this vulnerability to cause memory corruption on the client device before certificate authentication. This could lead to denial of service or potentially arbitrary code execution depending on the client's memory layout and exploitation conditions. The vulnerability has a CVSS 4.0 score of 9.3 (critical), indicating high impact with network attack vector, no privileges or user interaction required, and high confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, clients should avoid connecting to untrusted TLS 1.3 servers or use alternative TLS implementations if possible. Monitor vendor channels for updates and apply official fixes promptly once available.