CVE-2026-106464

Awaiting Analysis Awaiting Analysis - Queue

NULL Signature Length in wolfSSL Leading to Buffer Overflow

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Eclipse Foundation

Description

`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106464

EUVD

EUVD-2026-101502

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Foundation	NetX Duo 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in Eclipse ThreadX's NetX Duo software where the X.509 certificate parsing function incorrectly handles empty BIT STRING signatures. The function _nx_secure_x509_parse_signature_data computes the signature length as tlv_length - 1 without checking if tlv_length is zero, causing an integer underflow that wraps the length to 0xFFFFFFFF. This leads to an out-of-bounds read when the signature pointer exceeds the buffer.

Detection Guidance

Detecting this vulnerability requires inspecting NetX Duo versions and monitoring for crashes during TLS handshakes. Check installed versions with commands like 'grep -r "NetX Duo" /path/to/install' or 'nx_version_get()' in your application logs. Monitor system crashes or faults during TLS operations, especially when parsing X.509 certificates.

Impact Analysis

This vulnerability allows a remote, unauthenticated attacker to craft a malicious certificate that triggers an out-of-bounds read during TLS handshakes. This could cause a system crash or fault, potentially leading to denial of service. The impact is primarily on system availability as the flaw may disrupt normal operations.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially causing system crashes or faults during TLS handshakes due to out-of-bounds reads. This may lead to service disruptions or denial of service, which could violate availability requirements in these regulations.

Mitigation Strategies

Upgrade NetX Duo to version 6.5.2.202603a or later immediately. This version includes fixes for the BIT STRING length underflow and additional validation checks. If upgrading is not possible, disable TLS certificate validation as a temporary workaround, but note this weakens security and is not recommended.

Hi! I’m here to help you understand CVE-2026-106464. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70