CVE-2026-34875: CVSS 9.8 Buffer Overflow in Mbed TLS Enables Remote Code Execution

Mbed TLS patched a critical heap buffer overflow this week that scores 9.8 on the CVSS scale and leads directly to arbitrary code execution. CVE-2026-34875 affects the FFDH (Finite Field Diffie-Hellman) public key export path in every Mbed TLS 3.x release from 3.5.0 through 3.6.5, and TF-PSA-Crypto 1.0.0.

Mbed TLS is ARM’s embedded TLS library, deployed widely in IoT devices, embedded systems, RTOS environments, and any constrained-resource application that needs a lean TLS stack. If you’re running anything on microcontrollers, custom networking hardware, or embedded Linux where you control the TLS layer, you should treat this as high priority.

The vulnerability

The function psa_export_public_key() handles FFDH key export but does not verify that the caller’s output buffer is large enough to hold the full public key. If the caller allocates a buffer smaller than the key length — which is a legitimate use case when the application doesn’t know the key size ahead of time — the function writes the full key anyway, overflowing past the end of the allocated buffer.

This is a classic out-of-bounds write: the overflow corrupts adjacent heap memory, which under controlled conditions enables an attacker to achieve arbitrary code execution. The severity depends on attacker control over key material and buffer sizing. Where an attacker can influence both — for example by triggering key generation or exchange over a network protocol — the attack becomes fully remote.

Affected versions

• Mbed TLS 3.5.0 through 3.6.5
• TF-PSA-Crypto 1.0.0

Mbed TLS 2.x is not affected (the FFDH PSA API path is absent in that branch).

Fix

Upgrade to Mbed TLS 3.6.6 or TF-PSA-Crypto 1.1.0. Both releases add a buffer size check before the key write loop and return PSA_ERROR_BUFFER_TOO_SMALL cleanly if the caller’s buffer is insufficient.

# CMake fetch / submodule update
git fetch origin
git checkout v3.6.6

If you consume Mbed TLS as a vendored dependency, update your submodule or snapshot and rebuild. There is no workaround short of patching the source: the only safe fix is the upgrade.

Who should care

The Mbed TLS attack surface might seem narrow compared to OpenSSL, but the deployment footprint is enormous. Embedded TLS libraries power industrial controllers, network appliances, smart home devices, automotive ECUs, and a long tail of IoT infrastructure that runs unpatched for years. A CVSS 9.8 RCE in this space is serious precisely because upgrade cycles are slow and affected devices are often internet-exposed.

If you ship firmware that includes Mbed TLS, build the patch into your next release and push it. If you have a bug bounty or coordinated disclosure process, check whether customers with EOL hardware need a separate advisory.

The security advisory is published at the Mbed TLS documentation hub.