CVE-2026-93475: eclipse foundation eclipse threadx - netx duo Out-of-bounds Write

Vulnerability summary

CVE-2026-93475 is a critical (CVSS 9.3) Out-of-bounds Write vulnerability in eclipse foundation eclipse threadx - netx duo. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 14.9% of scored vulnerabilities.

Timeline

1. 20-10-2026
   PublishedVulnerability first disclosed.
2. 20-10-2026
   Last modifiedVulnerability information updated.

Description

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
• CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.