CVE-2026-102728: eclipse foundation netx duo Buffer Over-read

Vulnerability summary

CVE-2026-102728 is a high (CVSS 7.5) Buffer Over-read vulnerability in eclipse foundation netx duo. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.7% of scored vulnerabilities.

Timeline

1. 29-09-2026
   PublishedVulnerability first disclosed.
2. 30-09-2026
   Last modifiedVulnerability information updated.

Description

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.

• CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.