Out-of-bounds read in mbed TLS - CVE-2026-34876

Detailed vulnerability description

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in the CCM implementation (library/ccm.c) when processing the tag_len parameter in mbedtls_ccm_finish(). A remote attacker can send a specially crafted request with an oversized tag_len value to trigger an out-of-bounds read and disclose adjacent memory within the CCM context structure.

Exploitation requires the ability to invoke the multipart CCM API with controlled parameters. The vulnerability does not permit memory modification or direct code execution.

How to mitigate CVE-2026-34876

Sources

• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ccm-finish-boundary-check/