---
id: CVE-2026-106464
title: >-
  `_nx_secure_x509_parse_signature_data` computes the certificate signature's
  length as `tlv_length - 1` without first checking that `tlv_length` is
  non-zero
summary: >-
  `_nx_secure_x509_parse_signature_data` computes the certificate signature's
  length as `tlv_length - 1` without first checking that `tlv_length` is
  non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore
  parses succ…
severity: high
cwe:
  - CWE-125
  - CWE-191
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T18:17:24.960'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106464'
references:
  - url: >-
      https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-ww3q-3444-q488
    label: emo@eclipse.org
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/368'
    label: emo@eclipse.org
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-14T18:47:39.308Z'
vendor: Eclipse Foundation
product: NetX Duo
affected:
  - netx_duo <= 6.5.2.202603
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
---

## Overview

`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.