CVE-2026-92843: Eclipse NetX Duo NetX Secure heap out-of-bounds read in TLS 1.3 Certificate parser

CVE-2026-92843 · Severity: info · Published 2026-10-20

NetX Secure is a TLS/SSL library used in embedded systems and IoT devices to secure network communications. A malicious TLS 1.3 server can send a specially crafted Certificate message that triggers a heap memory read far beyond the intended buffer, potentially crashing the device or exposing sensitive data before the server is even authenticated. The vulnerability occurs during the normal TLS handshake before any certificate verification takes place.

Technologies: Eclipse NetX Duo. Vendors: Eclipse.

Quick answers

Is CVE-2026-92843 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92843 being exploited in the wild.
How severe is CVE-2026-92843?
Informational severity, published 20 October 2026.
Which products and versions are affected?
Eclipse NetX Duo <= 6.5.1.202602.
Is there a fix for CVE-2026-92843?
Yes: fixed in NetX Duo 6.5.2.202603. Until then: Building without NX_SECURE_TLS_TLS_1_3_ENABLED removes the affected code path entirely, though this disables TLS 1.3 support. Within a TLS 1.3-enabled build, no configuration or policy mitigation is available since the message is processed before server authentication. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92843 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-92843?
Check whether you run Eclipse NetX Duo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: NetX Duo 6.5.2.202603

Building without NX_SECURE_TLS_TLS_1_3_ENABLED removes the affected code path entirely, though this disables TLS 1.3 support. Within a TLS 1.3-enabled build, no configuration or policy mitigation is available since the message is processed before server authentication.

Technical details

The TLS 1.3 Certificate-message parser in _nx_secure_tls_process_remote_certificate fails to validate the two-byte extensions_length field before use, allowing an attacker to trigger an unsigned-integer underflow in the total_length counter. This causes the parser to advance past the message boundary, reading up to ~64 KiB of heap memory at attacker-controlled offsets. The vulnerability is reachable pre-authentication over the network with no privileges or user interaction required.

Affected products

  • Eclipse NetX Duo <= 6.5.1.202602

Timeline

  • 2026-10-02: disclosed
  • 2026-10-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.