CVE-2026-34877 | An issue was discovered in Mbed TLS versions from 2.19.0 up … | CVSS 9.8 CRITICAL

Description

An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.

Metadata

CVE ID: CVE-2026-34877
State: PUBLISHED
Assigner: mitre
Reserved: 2026-03-31 00:00 UTC
Published: 2026-04-02 00:00 UTC
Last updated: 2026-04-02 17:52 UTC
Primary CWE: CWE-250
CWE-250 Execution with Unnecessary Privileges
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-250	adp	CWE-250 Execution with Unnecessary Privileges
CWE-502	adp	CWE-502 Deserialization of Untrusted Data

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)