CVE-2018-0488

—

CVSS 3.0

9.8 critical

EPSS

5%p91

Published

Feb 13, 2018 (Feb 13, 2018)

Modified

Jun 17, 2026

Description

ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session.

Vendors: arm debian
Products: mbed tls, debian linux
Weakness: CWE-787
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.8%)

In the news0 stories

No ingested article mentions this CVE yet.