CVE-2026-102760CWE-416

CVE-2026-102760

published September 29, 2026

CVSS

8.3

EPSS

Percentile

10.3

In the wild

Unconfirmed

What it is

When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.

The record

Technical detail

CVSS: 8.3 · NONE
CVSS v4.0: 8.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00207 · 10.3th percentile
Weakness: CWE-416 · Use After Free
Published: 2026-09-29T22:17Z

References (1)

https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-8w5x-ff58-2fr2 · [email protected]

EPSS history

Timeline

01 OCT 03:44Z
EPSS moved — → 0%
epss
29 SEP 17:29Z
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP
cvelistv5