CVE-2026-93475— Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
Quick assessment
Affected
Eclipse Foundation Eclipse ThreadX - NetX Duo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NetX Secure 中的 X.509 解析器接受任意大小的 RSA 公钥，但所有签名验证路径均将解密结果写入固定大小的缓冲区，该缓冲区尺寸基于 的默认值（4096 位）。若证书携带的模数大于该默认值，在常规的证书链验证过程中，会导致文件作用域静态变量发生越界写入。 该漏洞可在未进行身份验证前被触发。由于执行加密操作时，颁发者信息会优先在远程对端提供的证书存储中查找，而非受信任存储，因此攻击者可自行提供包含超大模数的中间证书，并将其置于其提交的证书链中。该漏洞在以下场景中被触发：TLS 或 DTLS 客户端验证恶
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93475
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
Source: CVE Program / CVE List V5
Vulnerability Description
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification.
It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse ThreadX - NetX Duo | 0 ~ 6.5.1.202602 | - |
|
II. Public POCs for CVE-2026-93475
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93475
请登录查看更多情报信息。
Other References for CVE-2026-93475 (1)
Same Patch Batch · Eclipse Foundation · 2026-10-20 · 29 CVEs total
| CVE-2026-113620 | 9.8 CRITICAL | Eclipse ioFog operator WebSocket accepts an unverified JWT |
| CVE-2026-94018 | 8.8 HIGH | NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Lengt |
| CVE-2026-92853 | 8.7 HIGH | Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure |
| CVE-2026-92843 | 8.7 HIGH | Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure |
| CVE-2026-94192 | 8.5 HIGH | Module object deallocation can free a live ThreadX kernel object |
| CVE-2026-95109 | 8.5 HIGH | Cortex-A7 module data validation checks only the first address of a caller-supplied range |
| CVE-2026-91186 | 8.4 HIGH | PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing |
| CVE-2026-91041 | 7.8 HIGH | FileX fault-tolerant log replay writes past the destination sector when mounting a crafted |
| CVE-2026-113619 | 7.5 HIGH | Eclipse ioFog renders request templates before authentication |
| CVE-2026-91189 | 7.1 HIGH | GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a hea |
| CVE-2026-95107 | 7.0 HIGH | Module object allocation size overflow corrupts the manager object pool |
| CVE-2026-93003 | 6.9 MEDIUM | NetX Duo Web HTTP server interprets request body content as HTTP header fields |
| CVE-2026-108062 | 6.9 MEDIUM | Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event |
| CVE-2026-94024 | 6.9 MEDIUM | Module Manager object lookup validates one byte of a module's search name |
| CVE-2026-94023 | 6.9 MEDIUM | Module delete dispatchers do not enforce kernel-object ownership before irreversible delet |
| CVE-2026-95108 | 6.8 MEDIUM | Deleting a user-mode module thread leaks its privileged kernel stack |
| CVE-2026-91059 | 6.8 MEDIUM | JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allo |
| CVE-2026-92449 | 6.8 MEDIUM | Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds wri |
| CVE-2026-92446 | 6.8 MEDIUM | GUIX binary resource loader reads past the end of a resource, because no length for it eve |
| CVE-2026-97400 | 6.8 MEDIUM | jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when ope |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Eclipse ThreadX - NetX Duo
-
CVE-2026-93003
NetX Duo Web HTTP server interprets request body content as -
CVE-2026-92843
Out-of-bounds Read via the TLS 1.3 Certificate extensions_le -
CVE-2026-94018
NetX Duo Web HTTP server releases an uninitialized packet po -
CVE-2026-92853
Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Mes -
CVE-2026-103416
NetX Duo 6.5.1 TLS1.3 会话控制块越界写入漏洞
Same vendor: Eclipse Foundation
-
CVE-2026-93003
NetX Duo Web HTTP server interprets request body content as -
CVE-2026-95107
Module object allocation size overflow corrupts the manager -
CVE-2026-94202
Module block-pool create validates two of the four parameter -
CVE-2026-95108
Deleting a user-mode module thread leaks its privileged kern -
CVE-2026-94024
Module Manager object lookup validates one byte of a module'
Same weakness: CWE-787
-
CVE-2026-113679
HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAss -
CVE-2026-91041
FileX fault-tolerant log replay writes past the destination -
CVE-2026-109831
GNU UnRTF 越界写入漏洞致拒绝服务 -
CVE-2026-19595
Zephyr RTIO syscall verifier validates output parameters for -
CVE-2026-112397
Pillow: Out-of-bounds access in _imagingmorph on a zero-widt
V. Comments for CVE-2026-93475
No comments yet