CVE-2026-92853: CWE-125 Out-of-bounds Read in Eclipse Foundation Eclipse ThreadX - NetX Duo

The vulnerability arises from the TLS 1.3 Certificate-message parser in NetX Secure, which decrements the message length to skip a context byte without confirming that the message contains that byte. When a zero-length Certificate message is processed, the unsigned length underflows to 0xFFFFFFFF, rendering subsequent bounds checks ineffective and causing the parser to read beyond the allocated session packet buffer. The trigger is a minimal four-byte handshake header and can be reached without authentication or valid cryptographic handshake data.

An attacker can send a specially crafted TLS handshake message that causes the parser to read memory out-of-bounds. This can lead to information disclosure, application instability, or potential denial of service. The vulnerability is exploitable remotely without authentication and does not require valid cryptographic handshake data, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted TLS 1.3 Certificate messages or implement additional input validation to ensure message length correctness before parsing.