CVE-2026-93475

CVE-2026-93475 · Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.

CVSS 9.3 · Critical · EPSS 0.2%

Published

2026-10-20T15:04:30.044Z

Updated

2026-10-20T17:02:52.372Z

Check your server →