{"affected":[{"defaultStatus":"unaffected","product":"Eclipse ThreadX NetX Duo","source":"CNA: eclipse","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"6.5.2.202603","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.2.202603a"}]}],"cveId":"CVE-2026-106464","cwes":["CWE-125","CWE-191"],"description":"In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.","epss":{"date":"2026-11-03","percentile":0.0677,"score":0.00173},"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: eclipse","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793798459238,"publishedAt":1791999703585,"references":[{"source":"CNA: eclipse","tags":[],"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-ww3q-3444-q488"},{"source":"CNA: eclipse","tags":[],"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/368"}],"remediation":[],"revision":"e72cea4a38c6abfc606352b26795c0400624d240aab79c0b85d7ebe357b3d28f","sources":[{"modifiedAt":1793798459238,"name":"CNA: eclipse","retrievedAt":1793801326189,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106464"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793801400750,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106464"}],"ssvc":{"assessedAt":1792181611363,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing","updatedAt":1793801400750}