CVE-2026-102712 Information disclosure in NetX Duo
An unauthenticated attacker can trigger an out-of-bounds read in the DTLS parser to disclose adjacent process memory or cause a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102712?
CVE-2026-102712 is a high-severity vulnerability in Eclipse Foundation NetX Duo, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the
ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated
peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing
ServerHello, disclosing adjacent process memory over the network. The crash variant fires on the first
packet.
Weakness: CWE-125
Which versions are affected by CVE-2026-102712?
How do I fix CVE-2026-102712?
No fix has been published for CVE-2026-102712 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-102712 being exploited?
There is no known exploitation of CVE-2026-102712 in the wild and no public exploit code.
Sources
Also known as GHSA-52fg-7x3j-mp79, GHSA-5xr3-wpxf-rw5q.