Cyber Resilience

CVE-2024-45158

CriticalUpdated

Published: 05 September 2024

Published
05 September 2024
Modified
05 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0068 72.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-45158 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Trustedfirmware Mbed Tls. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 27.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of…

more

bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)

CWE(s)
CWE-121

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

trustedfirmware
mbed tls
3.6.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References