CVE-2026-34874
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer...
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.
- Record
CVE-2026-34874- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2026-18003
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.
- Record
EUVD-2026-18003- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5jpv-5p2x-4fwv
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer...
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.
- Record
GHSA-5jpv-5p2x-4fwv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.
- Record
CVE-2026-34874- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.
- Record
CVE-2026-34874- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-34874
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.
- Record
DEBIAN-CVE-2026-34874- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2026-34874
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.
- Record
UBUNTU-CVE-2026-34874- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10498-1 No score
libeverest-3.6.6-1.1 on GA media
These are all security issues fixed in the libeverest-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10498-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10615-1 No score
ovmf-202602-9.1 on GA media
These are all security issues fixed in the ovmf-202602-9.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10615-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20875-1 No score
Security update for ovmf
This update for ovmf fixes the following issues:
- CVE-2026-25833: mbedtls: buffer overflow in the
x509_inet_pton_ipv6()function (bsc#1261476). - CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477).
- CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478).
- CVE-2026-34874: mbedtls: NULL pointer dereference in distinguished name parsing (bsc#1261469).
- Record
openSUSE-SU-2026:20875-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1952-1 No score
Security update for ovmf
This update for ovmf fixes the following issues
- CVE-2026-25833: mbedtls: buffer underflow in x509_inet_pton_ipv6() (bsc#1261476).
- CVE-2026-25834: mbedtls: Algorithm downgrade vulnerability (bsc#1261477).
- CVE-2026-25835: mbedtls: PSA random generator cloning (bsc#1261478).
- CVE-2026-34874: mbedtls: NULL pointer dereference when setting a distinguished name (bsc#1261469).
Changes for ovmf:
- Update mbedtls to 3.6.6.
- Record
SUSE-SU-2026:1952-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21440-1 No score
Security update for ovmf
This update for ovmf fixes the following issues:
- CVE-2026-25833: mbedtls: buffer overflow in the
x509_inet_pton_ipv6()function (bsc#1261476). - CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477).
- CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478).
- CVE-2026-34874: mbedtls: NULL pointer dereference in distinguished name parsing (bsc#1261469).
- Record
SUSE-SU-2026:21440-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21981-1 No score
Security update for ovmf
This update for ovmf fixes the following issues:
- CVE-2026-25833: mbedtls: buffer overflow in the
x509_inet_pton_ipv6()function (bsc#1261476). - CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477).
- CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478).
- CVE-2026-34874: mbedtls: NULL pointer dereference in distinguished name parsing (bsc#1261469).
- Record
SUSE-SU-2026:21981-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22016-1 No score
Security update for ovmf
This update for ovmf fixes the following issues:
- CVE-2026-25833: mbedtls: buffer overflow in the
x509_inet_pton_ipv6()function (bsc#1261476). - CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477).
- CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478).
- CVE-2026-34874: mbedtls: NULL pointer dereference in distinguished name parsing (bsc#1261469).
- Record
SUSE-SU-2026:22016-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mbedtlsDebian:12 |
All versions, plus listed versions 2.28.3-12.28.4-12.28.5-12.28.6-12.28.7-1 Show 18 moreShow less2.28.7-1.12.28.7-1.1~exp12.28.8-13.6.0-13.6.0-23.6.0-33.6.2-13.6.2-23.6.2-33.6.3-13.6.4-13.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.13.6.6-0.1~deb13u13.6.7-23.6.7-3 |
None known |
mbedtlsDebian:13 |
before 3.6.6-0.1~deb13u1, plus listed versions 3.6.4-23.6.5-0.13.6.5-0.1~deb13u1 |
3.6.6-0.1~deb13u1 |
mbedtlsDebian:14 |
before 3.6.6-0.1, plus listed versions 3.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.1~deb13u1 |
3.6.6-0.1 |
ovmfSUSE:Linux Enterprise Server 16.0 From an advisory covering 4 CVEs |
before 202502-160000.5.1 | 202502-160000.5.1 |
ovmfSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 4 CVEs |
before 202502-160000.5.1 | 202502-160000.5.1 |
mbedtlsUbuntu:16.04:LTS |
All versions, plus listed versions 2.1.2-12.2.0-12.2.1-12.2.1-22.2.1-2ubuntu0.12.2.1-2ubuntu0.22.2.1-2ubuntu0.3 |
None known |
mbedtlsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.5.1-1ubuntu12.6.0-12.7.0-22.8.0-12.8.0-1ubuntu0.1~esm1 |
None known |
mbedtlsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.16.2-12.16.3-12.16.4-1ubuntu22.16.4-1ubuntu2+esm1 |
None known |
mbedtlsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.16.9-0.1ubuntu12.16.11-0.1ubuntu12.16.11-0.32.28.0-12.28.0-1build12.28.0-1ubuntu0.1~esm1 |
None known |
mbedtlsUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.28.3-12.28.6-1ubuntu12.28.7-1ubuntu12.28.7-1.1ubuntu12.28.8-12.28.8-1ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mbedtlsUbuntu:25.10 |
All versions, plus listed versions 3.6.2-3ubuntu1 |
None known |
mbedtlsUbuntu:26.10 |
All versions, plus listed versions 3.6.5-0.1ubuntu23.6.6-0.1ubuntu13.6.7-3ubuntu1 |
None known |
mbedtlsUbuntu:26.04:LTS |
All versions, plus listed versions 3.6.2-3ubuntu13.6.5-0.1ubuntu13.6.5-0.1ubuntu2 |
None known |
mbedtlsopenSUSE:Tumbleweed From an advisory covering 10 CVEs |
before 3.6.6-1.1 | 3.6.6-1.1 |
ovmfopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 202602-9.1 | 202602-9.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34874 is a high vulnerability (CVSS 7.5) in Trustedfirmware Mbed Tls, published April 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in mbedtls 3.6.6-0.1~deb13u1.
References
mbed-tls.readthedocs.io/en/latest/security-advisories
nvd.nist.gov/vuln/detail/CVE-2026-34874
github.com/advisories/GHSA-5jpv-5p2x-4fwv
security-tracker.debian.org/tracker/CVE-2026-34874
Show 20 moreShow less
suse.com/support/update/announcement/2026/suse-su-20261952-1
bugzilla.suse.com/1261469
ubuntu.com/security/CVE-2026-34874
cve.org/CVERecord?id=CVE-2026-34874