PT-2026-29820 · Arm · Mbed Tls

0Xiviel + 3 · CVE-2026-34877 · Published 2026-04-02 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.19.0 through 3.6.5, Mbed TLS version 4.0.0

Description A flaw exists in Mbed TLS that, due to insufficient protection of serialized SSL context or session structures, could allow an attacker who can modify these structures to cause memory corruption, potentially leading to arbitrary code execution. This is a result of Incorrect Use of Privileged APIs.

Recommendations Update to a version beyond 3.6.5. Update to a version beyond 4.0.0.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-250

Related Identifiers

CVE-2026-34877

ECHO-B6FA-1BCF-5451

OPENSUSE-SU-2026:10498-1

Affected Products

Mbed Tls

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34877.json · Exploit
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-serialized-data · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34877 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34877 · Security Note
• https://ubuntu.com/security/CVE-2026-34877 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34877 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10498-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34877 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34877 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2039976152442540357 · Twitter Post
• https://suse.com/security/cve/CVE-2026-34876 · Note
• https://suse.com/security/cve/CVE-2026-34877 · Note
• https://suse.com/security/cve/CVE-2026-34872 · Note