CVE-2026-106464

_nx_secure_x509_parse_signature_data computes the certificate signature's length as tlv_length - 1 without first checking that tlv_length is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of 0xFFFFFFFF and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.