In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Eclipse |
|
No data.
No data.
References
History
Wed, 04 Nov 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated. | In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault. |
| Title | Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing |
Sat, 17 Oct 2026 06:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Eclipse
Eclipse netx Duo |
|
| Vendors & Products |
Eclipse
Eclipse netx Duo |
Fri, 16 Oct 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 15 Oct 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | NetX Duo TLS Certificate Parsing Weakness Leading to Out‑of‑Bounds Access |
Wed, 14 Oct 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | NetX Duo TLS Certificate Parsing Weakness Leading to Out‑of‑Bounds Access |
Wed, 14 Oct 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated. | |
| Weaknesses | CWE-125 CWE-191 |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: eclipse
Published: 2026-10-14T17:41:43.585Z
Updated: 2026-11-04T13:20:59.238Z
Reserved: 2026-10-06T16:53:12.796Z
Link: CVE-2026-106464
Vulnrichment
Updated: 2026-10-16T20:13:38.037Z
NVD
Status : Awaiting Analysis
Published: 2026-10-14T18:17:24.960
Modified: 2026-11-04T14:17:20.820
Link: CVE-2026-106464
Redhat
No data.