Memory Leak in Mbed TLS Crypto Shim Driver Affecting Zephyr Project Software

CVE-2026-87044

What is CVE-2026-87044?

A vulnerability in the Mbed TLS crypto shim driver allows unauthenticated attackers to exploit the system by causing a memory leak. The issue arises during AES and AEAD operations where failures after setup can lead to memory not being freed correctly. This results in heap exhaustion, impacting the availability of subsequent cryptographic operations across the system until a reboot occurs. Although the frames with invalid MIC are rejected, this vulnerability poses a risk for devices relying on this faulty implementation, making it crucial to apply recommended fixes to prevent attackers from exhausting heap resources.

References