# CVE-2026-102713: NetX TFTP server heap buffer overflow in DATA handler

Source: https://junglewise.ai/threats/cve-2026-102713-the-tftp-server-accepts-a-data-datagram-of-any-size-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102713 · Severity: info · Published 2026-09-29

NetX's TFTP server component accepts DATA datagrams without validating their size against protocol limits, leading to two security flaws. An attacker can trigger heap buffer overflows that leak sensitive server memory back to the client, or send oversized datagrams that exhaust the packet pool and hang the server, denying service to all subsequent clients. Since TFTP requires no authentication, these attacks are available to any network attacker.

Technologies: [Microsoft NetX](https://junglewise.ai/threats/technologies/netx). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-102713 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102713 being exploited in the wild.

**How severe is CVE-2026-102713?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Microsoft NetX versions prior to patch.

**Is there a fix for CVE-2026-102713?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102713 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102713?** Check whether you run Microsoft NetX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The TFTP DATA handler in nxd_tftp_server.c passes the datagram length directly to FileX file write operations without checking the upper bound against NX_TFTP_FILE_TRANSFER_MAX. Because nx_packet_length measures a chain rather than a single buffer, FileX reads past the end of the first packet, causing heap-buffer-overflow and memory disclosure. Additionally, oversized datagrams force nx_packet_copy to request more packets than the pool holds, causing NX_WAIT_FOREVER to block indefinitely and starve all subsequent client requests.

## Affected products

- Microsoft NetX versions prior to patch

## Timeline

- 2026-09-29: disclosed

## Related threats

- [NetX DHCP client buffer over-read in option parsing](https://junglewise.ai/threats/cve-2026-102720-a-dhcp-server-or-anyone-on-the-lan-who-answers-a-discover-first)
- [NetX RTSP server packet pool exhaustion in Session header parsing](https://junglewise.ai/threats/cve-2026-102716-an-unauthenticated-client-can-drain-the-rtsp-server-s-packet)
- [NetX ICMPv6 option parsing buffer over-read and denial of service](https://junglewise.ai/threats/cve-2026-102714-nx-icmpv6-validate-options-scans-the-option-area-with-while)