Out-of-bounds read when parsing a zero-length ECC public key (CVE-2026-50583)

Title	Out-of-bounds read when parsing a zero-length ECC public key
CVE	CVE-2026-50583
Date	7th of July, 2026
Affects	All versions of Mbed TLS from 3.5.0 to 3.6.6 with driver-only ECC; all versions of Mbed TLS from 4.0.0 to 4.1.0; all versions of TF-PSA-Crypto up to 1.1.0
Not affected	Mbed TLS up to 3.4.1; Mbed TLS 3.5.0 through 3.6.6 with built-in ECC; Mbed TLS 3.6.7 and later 3.6.x versions; Mbed TLS 4.1.1 and later 4.1.x versions; Mbed TLS 4.2.0 and later 4.x versions; TF-PSA-Crypto 1.2.0 and later 1.x versions
Impact	Out-of-bounds read while parsing malformed ECC key material, potentially causing a crash
Severity	LOW

Vulnerability

When parsing malformed externally supplied ECC key material, Mbed TLS or TF-PSA-Crypto can read one byte past the supplied public-key buffer. The malformed input can be an ASN.1 SubjectPublicKeyInfo whose ECC public-key BIT STRING contains no ECPoint payload, or the optional publicKey field of a SEC1 ECPrivateKey.

In Mbed TLS, this issue can be reached through APIs that parse ECC public keys, EC private keys, certificates or CSRs, including mbedtls_pk_parse_public_key(), mbedtls_pk_parse_key(), mbedtls_x509_crt_parse() and mbedtls_x509_csr_parse().

Internally, the missing length check is in mbedtls_pk_ecc_set_pubkey(), which inspects the first byte of the encoded public key before validating that the supplied public-key buffer is non-empty.

In Mbed TLS 3.x, this code path is only used when MBEDTLS_PK_USE_PSA_EC_DATA is defined. Builds using the legacy ECP-backed representation are not affected. Mbed TLS 4.x is affected through its TF-PSA-Crypto submodule.

Impact

Out-of-bounds read while parsing malformed ECC key material, potentially causing a crash.

Affected versions

All versions of TF-PSA-Crypto up to 1.1.0 are affected.

All versions of Mbed TLS from 3.5.0 to 3.6.6 are affected in configurations where MBEDTLS_USE_PSA_CRYPTO and the PK module are enabled, PSA supports ECC through a driver, and built-in ECC support is disabled.

All versions of Mbed TLS from 4.0.0 to 4.1.0 are affected.

Work-around

Applications using vulnerable versions should avoid parsing ECC public keys, certificates, CSRs or EC private keys unless the input has first been validated to reject zero-length ECC public-key encodings.

Resolution

Affected users should upgrade to TF-PSA-Crypto 1.1.1 or a later 1.1.x version, or to TF-PSA-Crypto 1.2.0 or a later 1.x version.

Affected users should upgrade to Mbed TLS 3.6.7 or a later 3.6.x version, or to Mbed TLS 4.1.1 or a later 4.1.x version, or to Mbed TLS 4.2.0 or a later 4.x version.

Fix commits

We recommend that users upgrade to a release including the fix. However, if you are maintaining a branch with backported bug fixes, here are the most relevant commits. Please note that these commits may not apply cleanly to older versions of the library, and may not provide a complete fix even if they do apply. The TF-PSA-Crypto and Mbed TLS development team does not provide support outside of maintained branches.

Branch	Mbed TLS 3.6.x	TF-PSA-Crypto 1.1.x	TF-PSA-Crypto 1.x (x>1)	Mbed TLS 4.1.x	Mbed TLS 4.x (x>1)
Basic fix	0e2d7037db4048dbf1c194508c07384a818261d5	c99519080302cbcf19ad61d57c1d6fc614608336	e7183dbf9789834f89a5ed41f2156dcf34f130c3	N/A	N/A
With tests and documentation	aecc26ac7c523e741dd62d94890278326fe7c230..3208173d3d6728b6d1eb25a1a448067c781cbb69	de89cfc02ecb5a4ae67da155ebace3eff83555b2..32a2f6bb62dd3837951ccd546cb62638d56cbf61	feb70754b0a8d79f46d2c5f3eb8348c2212918c8..718f15d851316cbed7242b3a07b31c1712c51ef1	N/A	N/A