CVE-2026-93475: CWE-787 Out-of-bounds Write in Eclipse Foundation Eclipse ThreadX - NetX Duo

The X.509 parser in NetX Secure within Eclipse ThreadX - NetX Duo accepts RSA public keys of arbitrary size. However, all signature verification paths decrypt into fixed-size buffers dimensioned for the constant NX_CRYPTO_MAX_RSA_MODULUS_SIZE, which defaults to 4096 bits. If a certificate contains an RSA modulus larger than this size, it causes an out-of-bounds write past a static buffer during certificate-chain verification. The vulnerability is reachable without authentication because the issuer used for cryptographic operations is first looked up in the peer-supplied certificate store before the trusted store, allowing an attacker to supply an oversized intermediate certificate. This triggers during TLS or DTLS client verification of a malicious server's certificate chain and during server-side client-certificate authentication.

Successful exploitation can lead to memory corruption due to out-of-bounds writes, potentially allowing an attacker to crash the affected process or execute arbitrary code. The vulnerability is exploitable remotely without authentication during TLS or DTLS handshake processes, affecting both clients and servers using the vulnerable NetX Duo versions. The CVSS 4.0 score is 9.3 (critical), reflecting the high impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider mitigating exposure by restricting untrusted certificate chains or disabling client-certificate authentication where feasible. Monitor vendor communications for updates on remediation.