CVE-2026-106464CWE-125CWE-191

CVE-2026-106464

published October 14, 2026

CVSS
8.7
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00181 · 7.3th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2026-10-14T22:17Z
References (2)
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-ww3q-3444-q488 · [email protected]https://gitlab.eclipse.org/security/cve-assignment/-/work_items/368 · [email protected]
EPSS history
Timeline
  • 16 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 14 OCT 17:41Z
    `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero
    cvelistv5
  • 14 OCT 17:41Z
    `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero
    cvelistv5