PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6885 Matrixssl CVE debrief

CVE-2016-6885 is a denial-of-service flaw in MatrixSSL before 3.8.4. According to the NVD record, the pstm_exptmod function can hit an invalid free and crash when modular exponentiation is given a base zero value. The result is an availability impact only, but it is remotely reachable and rated HIGH in the NVD entry.

Vendor
Matrixssl
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-13
Original CVE updated
2026-05-13
Advisory published
2017-01-13
Advisory updated
2026-05-13

Who should care

Administrators and vendors using MatrixSSL, especially in embedded products or appliances that expose SSL/TLS functionality, should treat this as a patch-priority issue because the flaw can be triggered remotely and can crash the affected service.

Technical summary

The NVD description states that pstm_exptmod in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service through an invalid free and crash when a base zero value is used for modular exponentiation. NVD maps the weakness to CWE-416 and lists affected versions through 3.8.3.

Defensive priority

High. This is a remote, unauthenticated availability issue with a CVSS 3.0 score of 7.5 and no confidentiality or integrity impact, so it should be prioritized for upgrade planning and crash-risk reduction.

Recommended defensive actions

  • Upgrade MatrixSSL to version 3.8.4 or later, as identified in the vendor advisory and NVD references.
  • Inventory products and firmware that bundle MatrixSSL and verify whether they include a vulnerable version (3.8.3 or earlier).
  • If immediate upgrade is not possible, isolate exposed services and reduce attack surface until patched binaries can be deployed.
  • Add regression testing or validation around the affected code path to confirm the fix and detect crash conditions during maintenance testing.
  • Monitor logs and service stability for unexpected crashes that may indicate exposure on unpatched systems.

Evidence notes

This debrief is based only on the supplied NVD record and the linked vendor/third-party references. The NVD entry states the issue affects MatrixSSL before 3.8.4, describes an invalid free and crash in pstm_exptmod when the base value is zero, and assigns CVSS 3.0 7.5 (HIGH) with CWE-416. The MatrixSSL 3.8.4 release page is listed as a vendor patch reference, and the Fuzzing Project article is listed as a third-party advisory corroborating the crash condition.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6885 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6885

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6885 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6885

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.