CVE-2026-34876 — Out-of-bounds Read in ARM Mbed TLS

CWE-125 — Out-of-bounds Read18 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 95.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
ARM Mbed TLS
Timeline
PublishedApr 2
Latest updateApr 3

Description

An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized tag_len parameter. This is caused by missing validation of the tag_len parameter against the size of the internal 16-byte authentication buffer. The issue affects the public multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be invoked directl…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDarm/mbed_tls3.1.0 — 3.6.6

🔴Vulnerability Details

4
OSV
CVE-2026-34876: (An issue was discovered in Mbed TLS 3↗2026-04-03
▶
CVEList
CVE-2026-34876: An issue was discovered in Mbed TLS 3↗2026-04-02
▶
GHSA
GHSA-jw9g-6hxw-4whq: An issue was discovered in Mbed TLS 3↗2026-04-02
▶
OSV
CVE-2026-34876: An issue was discovered in Mbed TLS 3↗2026-04-02
▶

📋Vendor Advisories

1
Debian
CVE-2026-34876: mbedtls - An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vuln...↗2026
▶

🕵️Threat Intelligence

11
Wiz
CVE-2026-34873 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-34871 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-25835 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-34876 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-25833 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

1
Bugzilla
CVE-2026-34876 micropython: CCM multipart finish tag-length validation bypass [fedora-all]↗2026-04-02
▶
CVE-2026-34876 — Out-of-bounds Read in ARM Mbed TLS | cvebase