CVE-2024-49195 Memory corruption in n/a
A buffer underrun in Mbed TLS allows attackers to potentially execute code or cause denial of service when writing opaque key pairs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49195?
CVE-2024-49195 is a critical memory corruption vulnerability in n/a, published on 15 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair
Weakness: CWE-787
Which versions are affected by CVE-2024-49195?
It affects 1 product.
Linux distribution packages (1)
mbedtls openSUSE:Tumbleweed | All versions | 3.6.2-1.1 |
Products include Trustedfirmware Mbed Tls.
How do I fix CVE-2024-49195?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-49195 being exploited?
There is no known exploitation of CVE-2024-49195 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-34875 Memory corruption in n/a
- CVE-2024-45158 Memory corruption in n/a
- CVE-2024-45159 Auth bypass in n/a
- CVE-2023-45199 Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution.
- CVE-2026-34873 An issue was discovered in Mbed TLS 3.5.0 through 4.0.0.
Sources
Also known as ALPINE-CVE-2024-49195, DEBIAN-CVE-2024-49195, GHSA-24jq-7r79-4823, openSUSE-SU-2024:14419-1.