Is CVE-2026-34876 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34876 being exploited in the wild.

How severe is CVE-2026-34876?

High severity, with a CVSS score of 7.5, published 2 April 2026.

Which products and versions are affected?

TrustedFirmware Mbed TLS 3.1.0 to 3.6.5.

Is there a fix for CVE-2026-34876?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34876 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34876?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34876: Mbed TLS out-of-bounds read in mbedtls_ccm_finish

CVE-2026-34876 · Severity: high · CVSS 7.5 · Published 2026-04-02

Mbed TLS is a widely used encryption library that helps secure data transmission for embedded devices and applications. A flaw in its CCM encryption component could allow an attacker to read sensitive information from the system's memory. This could lead to the exposure of internal security keys or other private data, potentially compromising the confidentiality of encrypted communications.

Quick answers

Is CVE-2026-34876 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34876 being exploited in the wild.
How severe is CVE-2026-34876?: High severity, with a CVSS score of 7.5, published 2 April 2026.
Which products and versions are affected?: TrustedFirmware Mbed TLS 3.1.0 to 3.6.5.
Is there a fix for CVE-2026-34876?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34876 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34876?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in the mbedtls_ccm_finish() function within library/ccm.c. The root cause is a failure to validate the 'tag_len' parameter against the internal 16-byte authentication buffer (ctx->y) before performing a memcpy operation. In Mbed TLS 3.x, this function is part of the public multipart CCM API, allowing an attacker who can control API parameters to read adjacent memory in the mbedtls_ccm_context structure. This leaked data may include nonce/counter data, mode parameters, and block cipher context state. The issue is resolved in Mbed TLS 3.6.6 and 4.0.0.

Affected products

TrustedFirmware Mbed TLS 3.1.0 to 3.6.5

Timeline

2026-03-31: advisory: Vendor security advisory released
2026-04-02: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.