Description
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer.



The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.
Published: 2026-10-20
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer. The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.
Title Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
Weaknesses CWE-125
CWE-191
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-10-20T17:02:19.980Z

Reserved: 2026-09-23T13:43:04.315Z

Link: CVE-2026-92853

cve-icon Vulnrichment

Updated: 2026-10-20T17:02:15.295Z

cve-icon NVD

Status : Received

Published: 2026-10-20T16:17:17.277

Modified: 2026-10-20T18:17:22.843

Link: CVE-2026-92853

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T17:45:13Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-191

    Integer Underflow (Wrap or Wraparound)