What is the CVSS score of EUVD-2026-18394?

EUVD-2026-18394 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-18394?

Yes, a patch is available for EUVD-2026-18394. Update the affected software to the latest version immediately.

Mbed Tls EUVD-2026-18394

| CVE-2026-34877 CRITICAL

Execution with Unnecessary Privileges (CWE-250)

2026-04-02 cve@mitre.org

Privilege Escalation RCE Buffer Overflow Mbed Tls

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 02, 2026 - 17:22 euvd

EUVD-2026-18394

Analysis Generated

Apr 02, 2026 - 17:22 vuln.today

CVE Published

Apr 02, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.

AnalysisAI

Mbed TLS versions 2.19.0 through 3.6.5 and 4.0.0 allow remote code execution through memory corruption when attackers modify serialized SSL context or session structures. The vulnerability stems from insufficient validation of deserialized data, enabling arbitrary code execution on systems using affected versions. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Intercept serialized SSL context or session data

Exploit

Modify serialized structure without authentication

Execution

Trigger memory corruption during deserialization

Impact

Execute arbitrary code in application context

Access

Intercept serialized SSL context or session data

Exploit

Modify serialized structure without authentication

Execution

Trigger memory corruption during deserialization

Impact

Execute arbitrary code in application context

Vulnerability AssessmentAI

Exploitation	Attacker must have ability to modify serialized SSL context or session structures in Mbed TLS 2.19.0-3.6.5 or 4.0.0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS vector and score are not provided, limiting standard severity quantification. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker intercepts or modifies a serialized SSL session stored in a distributed cache or transmitted between application servers. When the application deserializes the modified session structure to resume the TLS connection, the malformed data triggers a buffer overflow in Mbed TLS's deserialization code, allowing the attacker to overwrite memory and execute arbitrary code with the privileges of the TLS library process. …
Remediation	Upgrade Mbed TLS to a patched version released by the vendor. … Detailed patch versions, workarounds, and compensating controls in full report.