EUVD-2026-18356Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized tag_len parameter. This is caused by missing validation of the tag_len parameter against the size of the internal 16-byte authentication buffer. The issue affects the public multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be invoked directly by applications. In Mbed TLS 4.x versions prior to the fix, the same missing validation exists in the internal implementation; however, the function is not exposed as part of the public API. Exploitation requires application-level invocation of the multipart CCM API.
AnalysisAI
Out-of-bounds read in Mbed TLS 3.x before 3.6.6 allows attackers to leak adjacent CCM context data through the multipart CCM API by passing an oversized tag_len parameter to mbedtls_ccm_finish(), which lacks validation against the internal 16-byte authentication buffer. Mbed TLS 4.x contains the same vulnerability in internal code but does not expose the vulnerable function publicly; exploitation requires direct application-level invocation of the affected API. No public exploit code or active exploitation has been reported, but the attack requires no special privileges.
Technical ContextAI
The vulnerability exists in the Counter with CBC-MAC (CCM) authenticated encryption mode implementation within Mbed TLS, a widely-used cryptographic library. CCM is an AEAD cipher mode defined in RFC 3610, combining AES counter mode with CBC-MAC for authentication. The multipart CCM API allows applications to incrementally process data across multiple function calls; mbedtls_ccm_finish() finalizes the operation and computes the authentication tag. The root cause is insufficient bounds checking on the tag_len parameter, which controls how many bytes are written from a fixed 16-byte internal authentication buffer. When an application supplies a tag_len larger than 16, the read operation accesses memory beyond the buffer boundary, exposing adjacent CCM context data (encryption keys, nonces, or other sensitive state). This is a classic out-of-bounds read vulnerability (CWE category: buffer boundary violation). The issue is specific to Mbed TLS 3.x where the multipart API is public; in 4.x, the same code path exists internally but is not part of the public API surface, limiting attack surface.
RemediationAI
Upgrade Mbed TLS 3.x to version 3.6.6 or later, which includes bounds validation for the tag_len parameter in mbedtls_ccm_finish(). For Mbed TLS 4.x users, apply the corresponding security patch as described in the vendor advisory. Applications should validate tag_len input before invoking mbedtls_ccm_finish() or switch to the single-shot API (mbedtls_ccm_encrypt_and_authenticate) if the multipart API is not required. Review application code that uses the multipart CCM API to ensure tag_len is never user-controlled or is restricted to valid values (1-16 bytes per CCM specification). Refer to the official Mbed TLS security advisory at https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ccm-finish-boundary-check/ for detailed patch release information.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today