The vulnerability occurs when NetX Duo’s client-side TLS/DTLS handshake parsers read fields from a server-supplied message before validating that the message is long enough to contain those fields. This out‑of‑bounds read (CWE‑126) can allow an attacker to leak data beyond the intended buffer, potentially exposing sensitive information or causing a client crash.

Eclipse Foundation’s NetX Duo embedded networking stack. The advisory does not list specific firmware or library releases, so all current and future versions may be affected until a vendor fix is applied.

The flaw is remotely reachable via a malicious or malformed TLS/DTLS server; the need to establish a client TLS/DTLS session is the likely attack vector. The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests low current exploitation probability. As the vulnerability is not listed in CISA’s KEV catalog, publicly known exploitation is limited, but the potential impact warrants timely mitigation.