The NetX Secure X.509 parser accepts RSA public keys of arbitrary size, but all signature‑verification paths assume a 4096‑bit default modulus. When a certificate chain contains a larger modulus, the decryption routine performs an out‑of‑bounds write past a static buffer. This corruption occurs during ordinary certificate‑chain verification and can jeopardize confidentiality, integrity, or availability if exploited to overwrite executable or control data.

Affected products are the Eclipse ThreadX NetX Duo implementation of NetX Secure, specifically builds that use the default NX_CRYPTO_MAX_RSA_MODULUS_SIZE of 4096 bits. No specific product versions are listed, so all releases that have not applied a fix for this unbounded modulus handling are vulnerable. The flaw is reachable before authentication, meaning an attacker can trigger it during TLS or DTLS client verification of a malicious server chain and also on a server side when performing client‑certificate authentication.

The vulnerability carries a CVSS score of 9.3, indicating a high severity. EPSS score is not available, and it is not listed in the CISA KEV catalog. The attack vector is pre‑authentication and relies on an attacker supplying an oversized RSA modulus within an intermediate certificate of the chain they present. This can overwrite file‑scope static data and provoke undefined behavior; an attacker may potentially achieve remote code execution or denial‑of‑service, depending on the environment. The lack of an EPSS score suggests limited publicly observed exploitation, but the high CVSS and the nature of the flaw warrant prompt mitigation.