The TLS 1.3 Certificate-message parser in NetX Secure incorrectly decrements the message length to skip a context byte without checking that a byte exists. A zero-length Certificate message causes the unsigned length to wrap to 0xFFFFFFFF, rendering the subsequent bounds check vacuous. This allows the parser to read past the end of the session packet buffer, resulting in a memory read that can leak internal data. The weakness is characterized by overlapping CWE-125 and CWE-191 defects. The impact is a potential disclosure of sensitive information from the host’s memory space. Based on the description, the attack does not grant code execution but may compromise confidentiality or integrity of confidential data or logs.

Eclipse ThreadX – NetX Duo is the affected product. No specific affected version information is included in the advisory data. Reassess the version of NetX Secure installed on all embedded or RTOS-based systems to determine if the vulnerable parser is present. If an unpatched build is deployed, the system may be susceptible to this vulnerability.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available; however, the vulnerability is reachable pre-authentication via a four‑byte TLS handshake header and does not require cryptographic validity. As it is not listed in CISA’s KEV catalog, there is no evidence of active exploitation yet, but the conditions for successful exploitation are minimal for an attacker. The likely attack vector is a malicious TLS client that initiates a TLS 1.3 handshake with a zero-length Certificate message, causing the vulnerable library to read past the packet buffer and leak memory contents. Consequently, the risk is significant for any system that accepts arbitrary TLS traffic and implements NetX Secure.