CVE-2026-106464: CWE-125 Out-of-bounds Read in Eclipse Foundation NetX Duo

The vulnerability in Eclipse Foundation NetX Duo (CVE-2026-106464) arises from the _nx_secure_x509_parse_signature_data function computing the signature length as tlv_length - 1 without checking if tlv_length is zero. When a certificate with an empty ASN.1 BIT STRING signature is parsed, the signature length becomes 0xFFFFFFFF and the signature pointer points one byte past the buffer's end. This out-of-bounds read occurs during TLS handshake certificate parsing, allowing remote unauthenticated inputs to trigger the flaw.

An attacker can supply a specially crafted certificate with an empty ASN.1 BIT STRING signature during the TLS handshake, causing the vulnerable function to read memory out-of-bounds. This can lead to potential memory corruption or information disclosure. The vulnerability is remotely exploitable without authentication, increasing its risk. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, users should consider mitigating exposure by controlling certificate inputs or applying other TLS handshake protections if feasible.