CVE-2026-103416 Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-103416?
CVE-2026-103416 is a critical vulnerability in Eclipse ThreadX - NetX Duo, published on 7 Oct 2026.
Official description
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.
Weakness: CWE-787
Which versions are affected by CVE-2026-103416?
How do I fix CVE-2026-103416?
No fix has been published for CVE-2026-103416 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-103416 being exploited?
There is no known exploitation of CVE-2026-103416 in the wild and no public exploit code.
Sources
Also known as GHSA-4x76-j955-qhq2.