External risk intelligence

TLS 1.3 Client Hello Retry Memory Corruption.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-103415

This vulnerability resides in a TLS 1.3 client implementation within an embedded network stack (Eclipse ThreadX NetX Duo). Client-side TLS processing is not an internet-facing service or listener. While the client communicates over the network, it is not an edge gateway, web server, or public-facing service, making internet-scale exploitation of this specific client-side memory corruption unlikely.

Out-of-bounds Write

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in TLS 1.3 client processing that could allow a malicious server to overwrite memory. The issue arises when a client processes a HelloRetryRequest and improperly handles a server-provided cookie, potentially leading to memory corruption before full authentication. This vulnerability affects only the client-side of TLS 1.3 connections.

Flaw in TLS client handling of server cookies.
Matters for client security against compromised servers.
Confirm relevance and exposure; no immediate executive action implied.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by establishing a TLS 1.3 connection with a vulnerable client. By sending a specially crafted HelloRetryRequest, the attacker can trick the client into copying an oversized or malformed cookie into its next message, leading to memory corruption on the client side before full authentication.

Requires network access.
Triggered by processing HelloRetryRequest.
Leads to client-side memory corruption.

Live Threat

Current exploitation, exposure, and threat context

A malicious or compromised server could potentially overwrite memory on the client side when a TLS 1.3 client processes a HelloRetryRequest, as the client copies the server's cookie without validating its size before authentication. This vulnerability only affects the client path.

Client memory integrity could be compromised.
Malicious servers may trigger memory corruption.
Unspecified client-side service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects TLS 1.3 client implementations, specifically within the Eclipse ThreadX NetX Duo network stack. Since only the client path is impacted, the immediate concern is for teams managing endpoints that initiate TLS 1.3 connections using this library. The first practical move is to identify all systems running this client software, determine their business criticality, and then ascertain the accountable owner for remediation planning.

Application or platform owners should manage the issue.
Verify affected client deployments and reachability.
Plan and coordinate remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Eclipse ThreadX NetX Duo?

Eclipse ThreadX NetX Duo is a network stack designed for embedded systems, providing essential communication protocols like TCP/IP and TLS. It is used in devices that require lightweight, real-time connectivity, allowing them to initiate secure network connections with servers.

What does CWE-787 mean for CVE-2026-103415?

This CVE falls under CWE-787, which is an Out-of-bounds Write weakness. It means the software writes data past the intended boundary of a memory buffer. In this case, the TLS client fails to verify the size of a cookie received from a server, leading it to overwrite adjacent memory when preparing its response.

How is this memory corruption triggered?

The vulnerability is triggered when a client receives a HelloRetryRequest from a server. If the server provides a malicious, oversized cookie, the client copies it into a buffer without checking the size constraints. Normal operations that do not use TLS 1.3 or do not trigger a HelloRetryRequest exchange are not affected.

Who should care about this CVE based on Halo Surface Signal?

While any system using the affected client library is logically impacted, Halo Surface Signal notes that this is a client-side library, not a public-facing service or web server. Because the vulnerability only affects the client path, it is generally not exposed as an internet-facing listener, making broad internet-scale exploitation less likely.

What are the first steps to address this?

Begin by identifying all devices or applications in your environment that utilize the Eclipse ThreadX NetX Duo network stack for TLS 1.3 connections. Once you have a list of deployments, assess their business criticality and coordinate with the product or platform owners to plan for updates as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.