CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

CVE-2026-102761

The NetX Duo WebSocket client is vulnerable to a memory corruption issue due to an incorrect unmasking cursor reset logic. When processing a chained packet, the client resets the cursor to the first NX_PACKET while the loop's upper bound remains tied to the current packet. In a standard contiguou...

CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

EUVD-2026-89210

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

PT-2026-102773

Name of the Vulnerable Software and Affected Versions NetX Duo affected versions not specified Description The WebSocket client incorrectly resets the unmasking cursor to the first NX PACKET when advancing through a chained packet, while the loop's upper bound remains tied to the current packet. ...

CVE-2026-102761: Out-of-bounds Write

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...