CVE-2017-2780: InsideSecure MatrixSSL X.509 Certificate Parsing Heap Buffer Overflow

CVE-2017-2780 is a critical heap-based buffer overflow (CWE-787) in the X.509 certificate parsing functionality of InsideSecure's MatrixSSL 3.8.7b, an embedded TLS/SSL library used by resource-constrained IoT clients and servers: when a vulnerable application initiates a secure connection and is presented with a specially crafted X.509 certificate, the certificate-parsing code can overflow a buffer on the heap, and NVD has published its own Primary CVSS v3.1 score of 9.8 (critical) for the resulting remote-code-execution risk.

CVE-2017-2780 (CWE-787, out-of-bounds write / heap buffer overflow) affects MatrixSSL 3.8.7b, an embedded TLS/SSL and cryptographic library originally built by PeerSec Networks and, at the time this CVE was disclosed, distributed by INSIDE Secure for IoT devices and other resource-constrained clients and servers that need a compact TLS stack. NVD's description states: "An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overflow on the heap resulting in remote code execution. To trigger this vulnerability, a specially crafted x509 certificate must be presented to the vulnerable client or server application when initiating secure connection" (NVD).

NVD lists the CVE's status as "Modified" with its own Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a Primary CVSS v2 score of 7.5; Cisco Talos, which disclosed the flaw, separately submitted a Secondary CVSS v3.0 score of 8.1 reflecting a higher attack-complexity assessment (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

NVD's reference list credits the disclosure to Cisco Talos's vulnerability report TALOS-2017-0276. NVD's own records show CVE-2017-2780 was published alongside two closely related MatrixSSL 3.8.7b X.509-parsing CVEs from the same Talos research effort: CVE-2017-2781, another exploitable heap buffer overflow in the certificate-parsing code, and CVE-2017-2782, an integer overflow in the same certificate-parsing functionality — all three published by NVD on the same day, 2017-06-22 (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.02344 (83.72nd percentile) as of 2026-11-06 — a long-standing, NVD-confirmed critical TLS-library flaw with an elevated exploitation-probability estimate relative to most CVEs, though no confirmed in-the-wild exploitation is on record (CISA KEV, FIRST EPSS).

Any device or application still shipping the InsideSecure MatrixSSL 3.8.7b certificate-parsing code — including firmware built years ago on this embedded TLS stack and left unpatched — should be updated to a fixed MatrixSSL release and treated as a priority if it accepts TLS connections, or validates client certificates, from untrusted networks.

• An exploitable heap buffer overflow exists in the X.509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b; a specially crafted X.509 certificate presented during secure-connection initiation can overflow a heap buffer, resulting in remote code execution. — NVD
• NVD status 'Modified'; NVD Primary CVSS v3.1 base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; NVD Primary CVSS v2 score 7.5; Cisco Talos's Secondary CVSS v3.0 score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). — NVD
• Disclosure is credited to Cisco Talos vulnerability report TALOS-2017-0276; two related MatrixSSL 3.8.7b X.509-parsing CVEs, CVE-2017-2781 (heap buffer overflow) and CVE-2017-2782 (integer overflow), were published by NVD the same day from the same research effort. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.02344 (83.72nd percentile) as of 2026-11-06. — FIRST EPSS