CVE-2026-34875
Buffer Overflow in Mbed TLS FFDH Public Key Export
Publication date: 2026-04-01
Last updated on: 2026-04-06
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| arm | mbed_tls | From 3.5.0 (inc) to 3.6.6 (exc) |
| arm | tf-psa-crypto | to 1.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-34875 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-34875 is a buffer overflow vulnerability in the Finite Field Diffie-Hellman (FFDH) public key export functionality within Mbed TLS. It occurs because the software improperly handles buffer sizes when exporting FFDH public keys, allowing an attacker to overwrite memory beyond the allocated buffer.
This happens due to insufficient input validation or boundary checks in the code responsible for serializing or exporting the public key data.
The vulnerability can lead to memory corruption, which might be exploited to cause crashes, execute arbitrary code, or compromise the security of cryptographic operations that rely on FFDH key exchanges.
How can this vulnerability impact me? :
This vulnerability can impact you by causing memory corruption through a buffer overflow during the export of FFDH public keys.
Potential impacts include application crashes, execution of arbitrary code by an attacker, and compromise of the security of cryptographic operations that depend on FFDH key exchanges.
What immediate steps should I take to mitigate this vulnerability?
The advisory mentions affected versions, impact, workarounds, and resolutions, but specific details on these aspects are not provided in the text.
Therefore, immediate mitigation steps are not explicitly detailed in the provided resources.