A buffer overflow occurs during public key export for FFDH keys in Mbed TLS and TF‑PSA‑Crypto, allowing an attacker to execute arbitrary code. The flaw is a classic memory corruption issue (CWE‑120). If exploited, an attacker can run malicious code with the same privileges as the affected application, potentially compromising confidentiality, integrity, and availability of the device or system.

ARM’s Mbed TLS versions up to and including 3.6.5, and TF‑PSA‑Crypto version 1.0.0 are vulnerable. These are commonly used on embedded devices that rely on cryptographic key generation and export functions.

The CVSS score of 9.8 classifies this as critical, yet the EPSS score of less than 1% suggests exploiting this bug is currently unlikely. It is not listed in the CISA KEV catalog. Based on the description, the attacker needs to trigger a key export operation—likely via an exposed API or internal process—before the overflow occurs. This inferred attack vector may allow remote exploitation if the key export function is reachable from a networked interface. The exploit would require a crafted key export request that overflows the buffer and injects code.