CVE-2026-106464
8.7HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-125, CWE-191
Impact
Remote unauthenticated attackers can crash the TLS service or trigger out-of-bounds reads during the TLS handshake. All they need is network connectivity to present a crafted X.509 certificate.
Root cause
An integer underflow occurs when subtracting one from an unchecked zero-length ASN.1 BIT STRING signature in `_nx_secure_x509_parse_signature_data`, wrapping the length to 0xFFFFFFFF and offsetting the pointer out of bounds.
Affected systems
Eclipse ThreadX NetX Duo (versions not listed — check the vendor advisory).
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Check the vendor advisory GHSA-ww3q-3444-q488 for the patched NetX Duo release and update the embedded firmware. If you cannot patch immediately, disable TLS listeners handling untrusted client certificates or restrict network access to trusted peers.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.