Stack-based buffer overflow in mbed TLS - CVE-2024-45158
Published: September 2, 2024 / Updated: July 13, 2026
Vulnerability identifier: #VU96650
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-45158
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the mbedtls_ecdsa_der_to_raw() and
mbedtls_ecdsa_raw_to_der() functions when the bits parameter is larger than the
largest supported curve and PSA is disabled. A remote attacker can send specially crafted packets to the application, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
mbed TLS
Fedora
mbedtls
mbedtls3.6
Fedora
mbedtls
mbedtls3.6
How to mitigate CVE-2024-45158
Install updates from vendor's website.
mbed TLS - update to 3.6.1
mbedtls - update to 2.28.9-1.fc41
mbedtls3.6 - update to 3.6.1-1.fc41
mbedtls - update to 2.28.9-1.fc41
mbedtls3.6 - update to 3.6.1-1.fc41