Certificate Signature Handling Flaw in Eclipse ThreadX NetX Duo

CVE-2026-106464

What is CVE-2026-106464?

A flaw exists in the certificate signature processing of the Eclipse ThreadX NetX Duo, where the function _nx_secure_x509_parse_signature_data computes the signature length in a way that does not check for a zero-length value from the tlv_length. This oversight allows a certificate with an empty ASN.1 BIT STRING to be parsed successfully, resulting in a signature length value of 0xFFFFFFFF and misaligning the pointer outside the permissible buffer range. The vulnerability is potentially exploitable during the TLS handshake phase, where certificates are exchanged from remote peers without requiring authentication, thereby allowing unauthorized access to manipulate secure communications.

References