The NetX Duo TLS 1.3 client copies the server’s cookie from a HelloRetryRequest into its own ClientHello without validating the cookie’s size or contents. Because the cookie originates from the server and the copy occurs before certificate authentication is complete, an attacker can send a crafted HelloRetryRequest that causes the client to write beyond its TLS packet buffer. This buffer overflow can corrupt memory and allows arbitrary code execution on the client device during the TLS handshake.

The vulnerability affects the NetX Duo client implementation provided by the Eclipse Foundation. No specific version numbers are supplied, so any build of NetX Duo containing the vulnerable TLS 1.3 HelloRetryRequest handling routine—including current releases prior to the fix—is potentially affected. Only the client side of the TLS handshake is impacted; the server side is not vulnerable.

With a CVSS score of 9.3 the flaw is considered critical. The EPSS score is <1%, but the high CVSS indicates that exploitation is likely if an attacker can target the client. The vulnerability is not yet listed in CISA’s KEV catalog. Because the exploit requires the client to connect to a malicious server, the attack vector is remote and does not require local privileges. An attacker can trigger the overflow by simply initiating a TLS 1.3 session with a crafted HelloRetryRequest and does not need any certificates, enabling easily automated exploitation.