CVE-2026-92853

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-92853

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92853.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-92853

Aliases

GHSA-893m-9g4r-4992

Published

2026-10-20T15:10:08Z

Modified

2026-10-21T03:00:15Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure

Details

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer.

The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.

Database specific

{
    "cna_assigner":  "eclipse",
    "cwe_ids":  [
        "CWE-125",
        "CWE-191"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92853.json"
}

References

Affected packages

Git / github.com/eclipse-threadx/netxduo

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-threadx/netxduo

Events

Introduced

Last Affected

1a0e9e43a03e37ddecfb6b49e9b078d6e1803d05

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "6.5.1.202602"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v.*

v.6.4.4.202503_rel

v6.*

v6.0.1_rel

v6.0.2_rel

v6.0_rel

v6.1.10_rel

v6.1.11_rel

v6.1.12_rel

v6.1.2_rel

v6.1.3_rel

v6.1.4_rel

v6.1.5_rel

v6.1.6_rel

v6.1.7_rel

v6.1.8_rel

v6.1.9_rel

v6.1_rel

v6.2.0_rel

v6.2.1_rel

v6.3.0_rel

v6.4.0_rel

v6.4.1_rel

v6.4.2_rel

v6.4.3_rel

v6.4.4.202503a

v6.4.5.202504_rel

v6.5.0.202601_rel

v6.5.1.202602_rel

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92853.json"