{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102758", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-09-29T16:21:58.057Z", "datePublished": "2026-09-29T17:26:44.424Z", "dateUpdated": "2026-09-30T20:42:39.497Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-09-29T17:26:44.424Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-126", "description": "CWE-126 Buffer Over-read", "type": "CWE"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "NetX Duo", "packageName": "NetX Duo", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "6.5.1.202602", "versionType": "custom"}, {"status": "unaffected", "version": "6.5.2.202603"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake.\n\n\n\nThe function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns `NX_SECURE_X509_ASN1_LENGTH_TOO_LONG`, but the read has already happened one byte past the end of the buffer.\n\n\n\ncode:\n\n\n\nnx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c\n\n\n\n```\n\n\n\nUINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type,\n\n USHORT *tlv_tag_class, ULONG *tlv_length,\n const UCHAR **tlv_data, ULONG *header_length)\n\n\n{\n\n\n\nUINT current_index;\n\n\n\nUSHORT current_tag;\n\n\n\nULONG length;\n\n\n\nULONG length_bytes;\n\n current_index = 0;\n current_tag = buffer[current_index]; /* <-- read before the bounds check */\n if (*buffer_length < 1)\n {\n return(NX_SECURE_X509_ASN1_LENGTH_TOO_LONG);\n }\n\n\n```\n\n\n\nThe remainder of the function is correctly ordered. The multi-byte length path is guarded by `length_bytes > 4 || length_bytes > *buffer_length` before its read loop, the decoded value is checked against `length > *buffer_length`, and the second single-byte length read follows its own `*buffer_length < 1` guard. The tag read is the only load placed ahead of its check.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake.</p><p>The function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns `NX_SECURE_X509_ASN1_LENGTH_TOO_LONG`, but the read has already happened one byte past the end of the buffer.</p><p>code:</p><p>nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c</p><p>```</p><p>UINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type,</p><code> USHORT *tlv_tag_class, ULONG *tlv_length,</code><br><code> const UCHAR **tlv_data, ULONG *header_length)</code><br><p>{</p><p>UINT current_index;</p><p>USHORT current_tag;</p><p>ULONG length;</p><p>ULONG length_bytes;</p><code> current_index = 0;</code><br><code> current_tag = buffer[current_index]; /* &lt;-- read before the bounds check */</code><br><code> if (*buffer_length &lt; 1)</code><br><code> {</code><br><code> return(NX_SECURE_X509_ASN1_LENGTH_TOO_LONG);</code><br><code> }</code><br><p>```</p><p>The remainder of the function is correctly ordered. The multi-byte length path is guarded by `length_bytes &gt; 4 || length_bytes &gt; *buffer_length` before its read loop, the decoded value is checked against `length &gt; *buffer_length`, and the second single-byte length read follows its own `*buffer_length &lt; 1` guard. The tag read is the only load placed ahead of its check.</p>"}]}], "references": [{"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-f95g-xc4w-mrcr"}], "credits": [{"lang": "en", "value": "tinic", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T20:42:14.455455Z", "id": "CVE-2026-102758", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:42:39.497Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-102758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T20:42:14.455455Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:42:35.929Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "tinic"}], "affected": [{"vendor": "Eclipse Foundation", "product": "NetX Duo", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.5.1.202602"}, {"status": "unaffected", "version": "6.5.2.202603"}], "packageName": "NetX Duo", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-f95g-xc4w-mrcr"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake.\n\n\n\nThe function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns `NX_SECURE_X509_ASN1_LENGTH_TOO_LONG`, but the read has already happened one byte past the end of the buffer.\n\n\n\ncode:\n\n\n\nnx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c\n\n\n\n```\n\n\n\nUINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type,\n\n USHORT *tlv_tag_class, ULONG *tlv_length,\n const UCHAR **tlv_data, ULONG *header_length)\n\n\n{\n\n\n\nUINT current_index;\n\n\n\nUSHORT current_tag;\n\n\n\nULONG length;\n\n\n\nULONG length_bytes;\n\n current_index = 0;\n current_tag = buffer[current_index]; /* <-- read before the bounds check */\n if (*buffer_length < 1)\n {\n return(NX_SECURE_X509_ASN1_LENGTH_TOO_LONG);\n }\n\n\n```\n\n\n\nThe remainder of the function is correctly ordered. The multi-byte length path is guarded by `length_bytes > 4 || length_bytes > *buffer_length` before its read loop, the decoded value is checked against `length > *buffer_length`, and the second single-byte length read follows its own `*buffer_length < 1` guard. The tag read is the only load placed ahead of its check.", "supportingMedia": [{"type": "text/html", "value": "<p>The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake.</p><p>The function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns `NX_SECURE_X509_ASN1_LENGTH_TOO_LONG`, but the read has already happened one byte past the end of the buffer.</p><p>code:</p><p>nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c</p><p>```</p><p>UINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type,</p><code> USHORT *tlv_tag_class, ULONG *tlv_length,</code><br><code> const UCHAR **tlv_data, ULONG *header_length)</code><br><p>{</p><p>UINT current_index;</p><p>USHORT current_tag;</p><p>ULONG length;</p><p>ULONG length_bytes;</p><code> current_index = 0;</code><br><code> current_tag = buffer[current_index]; /* &lt;-- read before the bounds check */</code><br><code> if (*buffer_length &lt; 1)</code><br><code> {</code><br><code> return(NX_SECURE_X509_ASN1_LENGTH_TOO_LONG);</code><br><code> }</code><br><p>```</p><p>The remainder of the function is correctly ordered. The multi-byte length path is guarded by `length_bytes &gt; 4 || length_bytes &gt; *buffer_length` before its read loop, the decoded value is checked against `length &gt; *buffer_length`, and the second single-byte length read follows its own `*buffer_length &lt; 1` guard. The tag read is the only load placed ahead of its check.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-126", "description": "CWE-126 Buffer Over-read"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-09-29T17:26:44.424Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102758", "state": "PUBLISHED", "dateUpdated": "2026-09-30T20:42:39.497Z", "dateReserved": "2026-09-29T16:21:58.057Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2026-09-29T17:26:44.424Z", "assignerShortName": "eclipse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "NetX Duo", "product": "NetX Duo", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "6.5.1.202602", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "6.5.2.202603"}]}], "source": "emo@eclipse.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake.\n\n\n\nThe function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns `NX_SECURE_X509_ASN1_LENGTH_TOO_LONG`, but the read has already happened one byte past the end of the buffer.\n\n\n\ncode:\n\n\n\nnx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c\n\n\n\n```\n\n\n\nUINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type,\n\n USHORT *tlv_tag_class, ULONG *tlv_length,\n const UCHAR **tlv_data, ULONG *header_length)\n\n\n{\n\n\n\nUINT current_index;\n\n\n\nUSHORT current_tag;\n\n\n\nULONG length;\n\n\n\nULONG length_bytes;\n\n current_index = 0;\n current_tag = buffer[current_index]; /* <-- read before the bounds check */\n if (*buffer_length < 1)\n {\n return(NX_SECURE_X509_ASN1_LENGTH_TOO_LONG);\n }\n\n\n```\n\n\n\nThe remainder of the function is correctly ordered. The multi-byte length path is guarded by `length_bytes > 4 || length_bytes > *buffer_length` before its read loop, the decoded value is checked against `length > *buffer_length`, and the second single-byte length read follows its own `*buffer_length < 1` guard. The tag read is the only load placed ahead of its check."}], "id": "CVE-2026-102758", "lastModified": "2026-09-30T21:17:05.347", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102758", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T20:42:14.455455Z", "version": "2.0.3"}}]}, "published": "2026-09-29T18:17:13.047", "references": [{"source": "emo@eclipse.org", "url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-f95g-xc4w-mrcr"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-126"}], "source": "emo@eclipse.org", "type": "Secondary"}]}

{}