CVE-2026-106464

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The function nx secure x509 parse signature data calculates the length of a certificate signature as tlv length - 1 without verifying if tlv length is non-zero. This allows a certificate with an empty ASN.1 BIT STRING signature to be parsed successfully, resulting in a signature length of 0xFFFFFFFF and a signature pointer positioned one byte beyond the buffer boundary. Since certificates are processed from a peer during the TLS handshake, this issue can be triggered by remote and unauthenticated input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.