CVEvulnerability

CVE-2026-34877

9.8 CRITICAL Published 2026-04-02 Modified 2026-07-24 Official page ↗

Status: Analyzed
Published: 2026-04-02
Last modified: 2026-07-24
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-250, CWE-502

Description

An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.

Affected configurations

• arm mbed tls (>= 2.19.0 < 3.6.6) • trustedfirmware mbed tls 4.0.0

Weakness · CWE (2)

CWE-250 Execution with Unnecessary Privileges weakness
CWE-502 Deserialization of Untrusted Data weakness

References

https://mbed-tls.readthedocs.io/en/latest/security-advisories/ Vendor Advisory
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-serialized-data/ Vendor Advisory

CVE-2026-34877

Description

Affected configurations

Related

Weakness · CWE (2)

References