CVE-2026-34877
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in Mbed TLS (versions 2.19.0 to 3.6.5 and 4.0.0) is caused by insufficient protection of serialized SSL structures. An attacker can modify these structures, leading to memory corruption and potential arbitrary code execution.
Risk Assessment
Risk of application takeover, potentially leading to full system compromise and data breach.
Recommendation
Update Mbed TLS to version 3.6.6 or later (or 4.1.0) if available. Restrict access to serialized SSL session data.
Original NVD description (English source)
An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.