Is CVE-2026-34877 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34877 being exploited in the wild.

How severe is CVE-2026-34877?

Critical severity, with a CVSS score of 9.8, published 2 April 2026.

Which products and versions are affected?

TrustedFirmware Mbed TLS 2.19.0 to 3.6.5, 4.0.0.

Is there a fix for CVE-2026-34877?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34877 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-34877?

Check whether you run Arm Mbed Tls. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34877: Mbed TLS memory corruption via insecure deserialization of SSL context

CVE-2026-34877 · Severity: critical · CVSS 9.8 · Published 2026-04-02

Mbed TLS is a widely used library that provides secure communication capabilities for embedded devices and applications. A vulnerability was identified where the library does not sufficiently protect internal session data when it is saved or restored. If an attacker can modify this saved data, they could cause the application to crash or potentially take control of the system, leading to a total compromise of the device's security and data.

Technologies: Arm Mbed Tls. Vendors: Arm.

Quick answers

Is CVE-2026-34877 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34877 being exploited in the wild.
How severe is CVE-2026-34877?: Critical severity, with a CVSS score of 9.8, published 2 April 2026.
Which products and versions are affected?: TrustedFirmware Mbed TLS 2.19.0 to 3.6.5, 4.0.0.
Is there a fix for CVE-2026-34877?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34877 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-34877?: Check whether you run Arm Mbed Tls. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Mbed TLS versions 2.19.0 through 3.6.5 and 4.0.0 due to the insecure deserialization of SSL context and session structures. The library provides APIs for applications to serialize TLS state for session resumption or caching but does not cryptographically sign or encrypt this data by default. If an attacker can modify the serialized buffer, the library may process malformed data structures during restoration, leading to out-of-bounds reads/writes or other memory corruption. While the vendor initially rated this as 'Low' due to the precondition of an attacker needing access to the serialized data, CISA-ADP has assigned a 'Critical' score (9.8) reflecting the potential for remote code execution if the storage mechanism is reachable. Documentation has been updated in versions 3.6.6 and 4.1.0 to mandate application-level integrity protection.

Affected products

TrustedFirmware Mbed TLS 2.19.0 to 3.6.5, 4.0.0

Timeline

2026-03-31: advisory: Vendor advisory released
2026-04-02: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.