The vulnerability arises from a missing bounds check in the TLS 1.3 Certificate‑message parser within NetX Secure. When a TLS 1.3 server transmits a crafted Certificate message, the parser can perform an unsigned‑integer underflow that causes a heap out‑of‑bounds read. This can lead to disclosure of sensitive data residing on the heap. The flaw is covered by CWE‑125 and is exploitable before any authentication or certificate verification completes.

The flaw affects the Eclipse ThreadX – NetX Duo family of networking stacks provided by the Eclipse Foundation. The advisory lists the product bundle but does not specify affected firmware or SDK release numbers, so any installation of NetX Secure that contains the TLS 1.3 Certificate‑message parser is potentially vulnerable.

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack can be launched by an attacker who controls a malicious TLS 1.3 server; no local privileges or authentication are required on the client side. The exploit path exists during the normal TLS handshake, before certificate verification ends, making it reachable from a remote network position. Because the flaw performs only a read, the impact is limited to information disclosure rather than code execution, but the lack of bounds checking can also increase the risk of stability issues.