NetX Duo TLS 1.3 Handshake Cache Out-of-bounds Write Vulnerability (CVE-2026-103416)

Vulnerability Overview Title: Out-of-bounds Write via the TLS 1.3 Handshake Message Cache in NetX Secure Description: Summary: The function caches each outgoing handshake message in a fixed 500-byte array within . If the handshake message exceeds the cache size, the write operation goes out of bounds into the rest of the session control block, which contains pointers. A malicious or compromised server can generate a message sent before certificate validation is complete, enabling exploitation without additional code. Details: The function iterates over outgoing packets, copying each fragment and updating the offset and record cache length. The fragment length and running total are not compared against the target capacity, leading to a copy beyond the end of the array. Attackers can trigger this vulnerability by sending a message exceeding 500 bytes. Impact Scope Affected Versions: NetX Duo <= 6.5.1.202602 Fixed Versions: NetX Duo 6.5.2.202603 CVSS Score: 9.8/10 (Critical) Attack Vector: Network Attack Complexity: Low User Interaction: None Privileges Required: None Impact Scope: High (Confidentiality, Integrity, Availability) Remediation Patch: Fixed in NetX Duo 6.5.2.202603. The fix includes checking whether the current offset is out of bounds before writing and returning an error if it is. Additionally, regression tests were added to ensure the fix is effective. Workaround: Disabling at build time can avoid the path, but this is not suitable for builds requiring TLS 1.3 as a client. Code Block Additional Information CVE ID: CVE-2026-103416 Weakness: CWE-787 Author: Frédéric Desbiens Generated by: AI-assisted generation, human-reviewed, compliant with the Eclipse Foundation General AI Usage Guidelines.

Goal Reached Thanks to every supporter — we hit 100%!

NetX Duo TLS 1.3 Handshake Cache Out-of-bounds Write Vulnerability (CVE-2026-103416)

More from this source