CVE-2026-92843: CWE-125 Out-of-bounds Read in Eclipse Foundation Eclipse ThreadX - NetX Duo

This vulnerability (CWE-125: Out-of-bounds Read) exists in the TLS 1.3 Certificate-message parser component of NetX Secure within Eclipse ThreadX - NetX Duo. Due to a missing bounds check, a malicious TLS 1.3 server can cause an unsigned-integer underflow leading to a heap out-of-bounds read in any peer processing a remote Certificate message. The flaw is reachable without authentication during the normal handshake process, prior to certificate verification, potentially exposing sensitive memory contents or causing denial of service.

An attacker controlling a malicious TLS 1.3 server can exploit this vulnerability to cause a heap out-of-bounds read on the client side during the handshake. This may lead to information disclosure or application instability. The vulnerability is exploitable without any prior authentication or user interaction, increasing its risk. However, no known exploits are reported in the wild at this time.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid connecting to untrusted TLS 1.3 servers or implement network-level controls to restrict connections to trusted servers only.