PT-2026-29789 · Arm · Mbed Tls

0Xiviel + 1 · Published 2026-04-02 · Updated 2026-04-07 · CVE-2026-34876

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 3.0 through 3.6.5

Description An out-of-bounds read issue exists in the mbedtls ccm finish() function within the library/ccm.c file of Mbed TLS. This allows attackers to potentially obtain adjacent CCM context data by invoking the multipart CCM API with an oversized tag len parameter. The root cause is the lack of validation of the tag len parameter against the size of the internal 16-byte authentication buffer. The issue impacts the public multipart CCM API in Mbed TLS 3.x, where mbedtls ccm finish() can be directly called by applications.

Recommendations Update to Mbed TLS version 3.6.6 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-34876

OPENSUSE-SU-2026:10498-1

Affected Products

Mbed Tls

References · 21

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34876 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ccm-finish-boundary-check · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34876 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34876 · Security Note
• https://ubuntu.com/security/CVE-2026-34876 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34876 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10498-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34876 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-34876 · Note
• https://suse.com/security/cve/CVE-2026-34873 · Note
• https://suse.com/security/cve/CVE-2026-34871 · Note
• https://suse.com/security/cve/CVE-2026-34874 · Note
• https://twitter.com/infoflowcloud/status/2039746420110942432 · Twitter Post
• https://suse.com/security/cve/CVE-2026-34872 · Note