CVE-2026-102760
HighCVSS 8.3Summary
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.
Risk Assessment
This can lead to memory corruption, potentially resulting in system crash or potential code execution by an attacker.
Recommendation
Apply the patch from the NetX Secure vendor. If possible, disable the `NX_SECURE_KEY_CLEAR` option or upgrade to a patched version.
Other vulnerabilities in NetX Secure
See all- CVE-2026-102758Unknown
In the `_nx_secure_x509_asn1_tlv_block_parse()` function in NetX Secure, there is an out-of-bounds read. The function reads the ASN.1 tag byte before checking that the buffer holds at least one byte, causing a one-byte over-read when the remaining length is zero. This affects parsing of X.509 certificates supplied by a remote peer during the TLS handshake.
- CVE-2026-102728Unknown
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
- CVE-2026-102719Medium
A vulnerability related to a predictable DTLS HelloVerifyRequest cookie in NetX Secure. The predictability of the cookie may allow an attacker to bypass the source address spoofing protection mechanism.
Original NVD description (English source)
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS