CVE-2026-102713: NetX TFTP server heap buffer overflow in DATA handler

CVE-2026-102713 · Severity: info · Published 2026-09-29

NetX's TFTP server component accepts DATA datagrams without validating their size against protocol limits, leading to two security flaws. An attacker can trigger heap buffer overflows that leak sensitive server memory back to the client, or send oversized datagrams that exhaust the packet pool and hang the server, denying service to all subsequent clients. Since TFTP requires no authentication, these attacks are available to any network attacker.

Technologies: Microsoft NetX. Vendors: Microsoft.

Quick answers

Is CVE-2026-102713 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102713 being exploited in the wild.
How severe is CVE-2026-102713?
Informational severity, published 29 September 2026.
Which products and versions are affected?
Microsoft NetX versions prior to patch.
Is there a fix for CVE-2026-102713?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-102713 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-102713?
Check whether you run Microsoft NetX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The TFTP DATA handler in nxd_tftp_server.c passes the datagram length directly to FileX file write operations without checking the upper bound against NX_TFTP_FILE_TRANSFER_MAX. Because nx_packet_length measures a chain rather than a single buffer, FileX reads past the end of the first packet, causing heap-buffer-overflow and memory disclosure. Additionally, oversized datagrams force nx_packet_copy to request more packets than the pool holds, causing NX_WAIT_FOREVER to block indefinitely and starve all subsequent client requests.

Affected products

  • Microsoft NetX versions prior to patch

Timeline

  • 2026-09-29: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.