Mbed TLS CVE-2025-49087

Exploitation conditions cannot be determined from available data - no CVSS vector, CWE, or technical description has been published. Authentication requirements, attack vector (network, adjacent, or local), required user interaction, and whether non-default configurations are needed are all unknown. What IS confirmed: the vulnerability exists in Mbed TLS as packaged for Alpine Linux in versions prior to 3.6.4-r0. Defenders should not assume exploitability is high or low without consulting a vendor advisory with full technical disclosure.

Risk assessment is severely constrained by missing data. No CVSS vector is available, meaning attack vector (network vs. local), complexity, privilege requirements, user interaction, and scope cannot be evaluated from authoritative scoring. No CWE is assigned, so the vulnerability class (e.g., buffer overflow, use-after-free, cryptographic flaw) is unknown. EPSS at 0.43% with 63rd percentile ranking indicates moderate relative exploit likelihood compared to the CVE corpus but low absolute probability of exploitation within 30 days. KEV status is absent, indicating CISA has not confirmed active exploitation. No POC is known. The net assessment is: this is a real fix for a real flaw in a widely deployed cryptographic library, but the absence of CVSS, CWE, and technical detail prevents confident prioritization beyond 'apply the available patch promptly, especially in Alpine environments using mbedtls.'

Without CVSS vector or technical description, a realistic attack scenario cannot be constructed from confirmed data. Generically, if the flaw is in TLS processing (consistent with Mbed TLS's function), a remote attacker could potentially send a crafted TLS message to a service using an affected mbedtls build to trigger the vulnerability. No POC exists in available intelligence, and no active exploitation has been reported.