CVE-2026-106464: Integer Underflow
nxsecurex509parsesignaturedata computes the certificate signature's length as tlvlength - 1 without first checking that tlvlength is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of 0xFFFFFFFF and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.
Affected Software
Event History
Frequently Asked Questions
Who can trigger this issue?
A remote, unauthenticated peer can supply the malformed certificate during the TLS handshake. Systems using NetX Secure to parse peer certificates are exposed to this input path.
What malformed input is required?
The peer certificate must contain an ASN.1 BIT STRING for the certificate signature with a zero TLV length. This causes the signature length calculation to underflow to 0xFFFFFFFF and advances the signature pointer past the input buffer.
Does this require a trusted or authenticated TLS peer?
No. The certificate is parsed from the peer during the TLS handshake, before the peer is authenticated.