CVE-2017-18187: Arm Mbed TLS

Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days.

In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.

Affected products

• Arm Mbed TLS: before 2.7.0 (fixed in 2.7.0)
• Debian Debian Linux: version 8.0 only; version 9.0 only

Published 2018-02-14. Last modified 2026-06-17.