Eclipse NetX Duo up to 6.5.1.202602 ASN.1 TLV Block Parsing nx_secure_x509_asn1_tlv_block_parse.c _nx_secure_x509_asn1_tlv_block_parse out-of-bounds

Summaryinfo

A vulnerability marked as critical has been reported in Eclipse NetX Duo up to 6.5.1.202602. This vulnerability affects the function _nx_secure_x509_asn1_tlv_block_parse of the file nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c of the component ASN.1 TLV Block Parsing. Performing a manipulation results in out-of-bounds. This vulnerability was named CVE-2026-102758. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Eclipse NetX Duo up to 6.5.1.202602. It has been classified as critical. This affects the function _nx_secure_x509_asn1_tlv_block_parse of the file nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c of the component ASN.1 TLV Block Parsing. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake. The function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns `NX_SECURE_X509_ASN1_LENGTH_TOO_LONG`, but the read has already happened one byte past the end of the buffer. code: nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c ``` UINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type, USHORT *tlv_tag_class, ULONG *tlv_length, const UCHAR **tlv_data, ULONG *header_length) { UINT current_index; USHORT current_tag; ULONG length; ULONG length_bytes; current_index = 0; current_tag = buffer[current_index]; /* <-- read before the bounds check */ if (*buffer_length < 1) { return(NX_SECURE_X509_ASN1_LENGTH_TOO_LONG); } ``` The remainder of the function is correctly ordered. The multi-byte length path is guarded by `length_bytes > 4 || length_bytes > *buffer_length` before its read loop, the decoded value is checked against `length > *buffer_length`, and the second single-byte length read follows its own `*buffer_length < 1` guard. The tag read is the only load placed ahead of its check.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-102758 since 09/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 6.5.2.202603 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• NetX Duo

Version

• 6.5.1.202602

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion