Eclipse NetX Duo: Out-of-bounds read via empty certificate signature
Summary
NetX Duo, the TCP/IP and TLS component of Eclipse ThreadX, wraps the certificate signature length to 0xFFFFFFFF when parsing a certificate whose signature is an empty ASN.1 BIT STRING. During signature verification this leads to a read far outside the certificate buffer, which is expected to crash the device. An unauthenticated remote peer can trigger this during a TLS handshake by sending a crafted certificate, so embedded devices using NetX Duo are affected. Whether data can be leaked is not established; the CVSS score reflects availability impact only.
Affected
- Eclipse NetX Duo up to and including 6.5.2.202603
- Embedded products and firmware built on these releases (device vendor to confirm)
Fixed in
- Eclipse NetX Duo 6.5.2.202603a
Workaround
- None that preserve certificate validation.
- Declining to parse certificates from untrusted peers is not a workaround for TLS.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not listed in CISA KEV; EPSS 0.00181.
- No public proof of concept or in-the-wild exploitation known.
Our recommendation
- Inventory devices and firmware that embed NetX Duo or Eclipse ThreadX.
- Ask device vendors for firmware built on NetX Duo 6.5.2.202603a or later and apply it.
- Limit network access to devices with TLS, especially if they accept client certificates or connect to untrusted endpoints.
- Check the GHSA advisory and NVD for the final affected range and analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-ww3q-3444-q488 github.com
- Fix pull request #479 github.com
- OSV entry CVE-2026-106464 osv.dev
- CVE record mirror (OpenCVE) app.opencve.io
- VulnRichment record (Vulners) vulners.com
- Eclipse CVE assignment ticket gitlab.eclipse.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:50.
Original description (NVD)
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.