CVE-2018-0488

high

Published — · Modified —

CVSS v3

—

CVSS v2

—

VIR risk

8.0

Description

ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2018-0488

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-201802-15

OS impact

OS	Version	Status	Fixed in
arch		fixed	`2.7.0-1`
debian	bookworm	fixed	`2.7.0-2`
debian	bullseye	fixed	`2.7.0-2`
debian	forky	fixed	`2.7.0-2`
debian	sid	fixed	`2.7.0-2`
debian	trixie	fixed	`2.7.0-2`

References

https://security.archlinux.org/ASA-201802-15
https://security-tracker.debian.org/tracker/CVE-2018-0488

Verify integrity in audit chain (admin only). AS-IS.