Mbed TLS 3.x before version 3.6.6 contains an out‑of‑bounds read in the function mbedtls_ccm_finish() where the tag_len parameter is not validated against the internal 16‑byte authentication buffer. An attacker who can invoke the multipart CCM API may supply an oversized tag_len and read data that lies just beyond the intended buffer. This allows the leakage of adjacent CCM context data, potentially exposing sensitive authentication material and compromising confidentiality.

The vulnerability affects the open‑source Mbed TLS cryptographic library. All 3.x releases prior to 3.6.6 are exposed, as the public multipart CCM API allows direct invocation of mbedtls_ccm_finish(). Mbed TLS 4.x contains the same internal missing validation, but the function is not publicly exposed, so the risk is limited to library developers. No vendor or product name beyond Mbed TLS is listed.

Exploitation requires application‑level use of the multipart CCM API and the ability to supply an oversized tag_len. It does not provide remote code execution or denial of service, but it enables covert data leakage. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation yet. However, the CVSS score is high enough that any system using the affected library should apply the patch promptly.