CVE-2026-34876 | mbed TLS up to 3.6.5 Multipart CCM API library/ccm.c mbedtls_ccm_finish tag_len out-of-bounds

A vulnerability was found in mbed TLS up to 3.6.5. It has been classified as problematic. The impacted element is the function mbedtls_ccm_finish of the file library/ccm.c of the component Multipart CCM API. Performing a manipulation of the argument tag_len results in out-of-bounds read.

This vulnerability was named CVE-2026-34876. The attack may be initiated remotely. There is no available exploit.

Upgrading the affected component is recommended.