CVE-2026-102712CWE-125

CVE-2026-102712

published September 29, 2026

CVSS
8.8
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the

ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated

peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing

ServerHello, disclosing adjacent process memory over the network. The crash variant fires on the first

packet.

The record
Technical detail
CVSS
8.8 · NONE
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00253 · 15.8th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-09-29T22:17Z
References (1)
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-5xr3-wpxf-rw5q · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 17:39Z
    On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record…
    cvelistv5