An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before…

Description

An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.

Scores

EPSS (exploitation in 30 days)

3.4% · top 11% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Weakness

• Stack pointer vulnerability
• CWE-295 (opens in a new tab)All about CWE-295 and its CVEs

Affected products

• ARM · mbed TLS

  • affected 2.4.0

References (3)

• GLSA-201706-18 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• http://www.talosintelligence.com/reports/TALOS-2017-0274/ (opens in a new tab)x_refsource_MISCx_transferred
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-2784](https://trackcve.app/badge/CVE-2017-2784.svg)](https://trackcve.app/cve/CVE-2017-2784)

Record last updated 5 Aug 2024, 14:02 UTC.