Mongoose EUVD-2026-18170

This vulnerability presents moderate-to-high real-world risk requiring prompt remediation. The CVSS base score of 7.3 accurately reflects the threat profile: network-accessible (AV:N), low attack complexity (AC:L), requires no authentication (PR:N) or user interaction (UI:N), with partial impact across all three security properties (C:L/I:L/A:L). The temporal score factor E:P confirms publicly available exploit code exists, significantly lowering the barrier to exploitation. Attack complexity is genuinely low - any attacker capable of initiating TLS 1.3 connections can deliver malicious certificates. However, the partial CIA impacts (Low across all dimensions) and unsegmented scope (S:U) suggest exploitation may not immediately yield complete system compromise, depending on implementation context and exploit sophistication. The vendor's rapid response with patch 7.21 and explicit commit reference (0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1) demonstrates clear remediation path. Real-world prioritization depends on deployment context: internet-facing Mongoose instances handling TLS 1.3 connections warrant immediate patching, while isolated or TLS-disabled deployments face reduced urgency. No CISA KEV listing indicates no confirmed active exploitation campaigns at time of analysis, though public POC availability means exploitation capability exists in attacker communities.

An unauthenticated remote attacker initiates a TLS 1.3 connection to a vulnerable Mongoose-based web server or IoT device. During the handshake, the attacker presents a specially crafted X.509 certificate containing an oversized or malformed public key field designed to trigger the heap overflow in mg_tls_recv_cert(). The overflow corrupts adjacent heap structures, potentially allowing the attacker to manipulate program execution flow, leak sensitive memory contents, cause denial of service through application crash, or achieve limited code execution depending on heap layout and exploitation technique sophistication. Publicly available exploit code exists, enabling script-level attackers to target vulnerable endpoints without deep technical expertise.