{"id":"CVE-2026-102712","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102712","generatedAt":"2026-10-28T09:27:24.716Z","title":"An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing ServerHello, disclosing adjacent process memory over the network.","description":"On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the\n\n\n\nciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated\n\n\n\npeer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing\n\n\n\nServerHello, disclosing adjacent process memory over the network. The crash variant fires on the first\n\n\n\npacket.","published":"2026-09-29T18:17:10.000Z","lastModified":"2026-09-29T22:17:08.000Z","status":"Awaiting Analysis","sourceIdentifier":"emo@eclipse.org","cvss":{"version":"4.0","score":8.8,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-125"],"affected":[],"epss":{"score":0.00253,"percentile":0.16668,"date":"2026-10-27","history":[{"date":"2026-09-30","score":0.00253,"percentile":0.15143}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.25%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-29T18:17:10.000Z","detail":{"score":"8.8","severity":"HIGH","publishedAt":"2026-09-29T18:17:10.320Z"},"summary":"New CVE, high severity (CVSS 8.8)."}],"references":[{"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-5xr3-wpxf-rw5q","source":"emo@eclipse.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102712","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}