CVE-2026-106464
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length -…
- Risk score
- 58/100
- CVSS
- 8.7 v4.0
- Exploit chance (30 days)
- 0.2%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- _nx_secure_x509_parse_signature_data computes the certificate signature's length as tlv_length - 1 without first checking that tlv_length is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of 0xFFFFFFFF and a signa…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.7 high
- Remotely exploitable without logging in
References
Original description
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.
Last activity 14 Oct 2026. Patch Forecast updates every hour.