CVE-2026-93475
CVE-2026-93475 · Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.
CVSS 9.3 · Kritisch · EPSS 0,2% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
eclipse threadx - netx duo
- Softwareversionen
- ≥ 0, ≤ 6.5.1.202602: Betroffen (semver)
- 6.5.2.202603: Nicht betroffen
Auf 6.5.2.202603 aktualisieren