CVE-2026-106464

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-16
Weakness: CWE-125

Description

`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.

Affected products

Eclipse Foundation NetX Duo: through 6.5.2.202603

References

https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-ww3q-3444-q488
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/368

Get alerted when CVE-2026-106464 or the next vulnerability affects your stack