CVE-2026-34877 Deserialization in n/a
Attackers can achieve arbitrary code execution by modifying serialized SSL context or session structures in Mbed TLS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34877?
CVE-2026-34877 is a critical unsafe deserialization vulnerability in Arm Mbed Tls, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.
Which versions are affected by CVE-2026-34877?
It affects 2 products.
Products include Arm Mbed Tls, Trustedfirmware Mbed Tls.
How do I fix CVE-2026-34877?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-34877 being exploited?
There is no known exploitation of CVE-2026-34877 in the wild and no public exploit code.
Other vulnerabilities in Arm Mbed Tls
- CVE-2022-46393 Memory corruption in n/a
- CVE-2021-44732 Use after free in n/a
- CVE-2017-18187 Integer overflow in n/a
- CVE-2018-0487 Memory corruption in ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0
- CVE-2018-0488 Memory corruption in ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0
Sources
Also known as DEBIAN-CVE-2026-34877, GHSA-xg3m-c464-j5fh, JLSEC-2026-467, UBUNTU-CVE-2026-34877.