Is CVE-2026-34875 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34875 being exploited in the wild.

How severe is CVE-2026-34875?

Critical severity, with a CVSS score of 9.8, published 1 April 2026.

Which products and versions are affected?

TrustedFirmware Mbed TLS 3.5.0 to 3.6.5; TrustedFirmware TF-PSA-Crypto 1.0.0.

Is there a fix for CVE-2026-34875?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34875 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34875?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34875: Mbed TLS buffer overflow in FFDH public key export

CVE-2026-34875 · Severity: critical · CVSS 9.8 · Published 2026-04-01

Mbed TLS is a widely used open-source cryptographic library that helps devices communicate securely over the internet. A security flaw has been identified where the library fails to verify memory limits when exporting certain security keys. If exploited, this could allow an attacker to crash the system or potentially take control of the device by executing unauthorized code.

Quick answers

Is CVE-2026-34875 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34875 being exploited in the wild.
How severe is CVE-2026-34875?: Critical severity, with a CVSS score of 9.8, published 1 April 2026.
Which products and versions are affected?: TrustedFirmware Mbed TLS 3.5.0 to 3.6.5; TrustedFirmware TF-PSA-Crypto 1.0.0.
Is there a fix for CVE-2026-34875?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34875 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34875?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in the psa_export_public_key() function within Mbed TLS and TF-PSA-Crypto. The vulnerability is caused by a failure to validate the size of the user-supplied output buffer when exporting Finite Field Diffie-Hellman (FFDH) public keys. If an application provides a buffer smaller than the key size, the function writes past the buffer boundaries, leading to memory corruption. An attacker who can influence the key export process could leverage this to achieve arbitrary code execution or cause a denial of service. The issue is resolved in Mbed TLS 3.6.6 and TF-PSA-Crypto 1.1.0.

Affected products

TrustedFirmware Mbed TLS 3.5.0 to 3.6.5
TrustedFirmware TF-PSA-Crypto 1.0.0

Timeline

2026-03-31: advisory: Vendor advisory released by Mbed TLS team
2026-04-01: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.