CVE-2026-106464 — Vulnerability intelligence
—
Published:
- CVSS
- 8.7
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.