EUVD-2025-20080Severity by source
AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid signature. In mbedtls_lms_verify, the return values of the internal Merkle tree functions create_merkle_leaf_value and create_merkle_internal_value are not checked. These functions return an integer that indicates whether the call succeeded or not. If a failure occurs, the output buffer (Tc_candidate_root_node) may remain uninitialized, and the result of the signature verification is unpredictable. When the software implementation of SHA-256 is used, these functions will not fail. However, with hardware-accelerated hashing, an attacker could use fault injection against the accelerator to bypass verification.
AnalysisAI
A security vulnerability in MbedTLS 3.3.0 (CVSS 4.9). Remediation should follow standard vulnerability management procedures.
Technical ContextAI
Vulnerability type not specified by vendor. Affects MbedTLS 3.3.0.
RemediationAI
Monitor vendor channels for patch availability.
Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_sessi
An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. Rated critical severity (CVSS 9.1), this vulnera
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may b
Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution. Rated critical sev
An issue was discovered in Mbed TLS 3.5.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
Alpine Linux: mbedtls fixed in 3.6.2-r0
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. Rated critical severity (CVSS 9.8), this vulnera
Alpine Linux: mbedtls fixed in 3.6.1-r0
Alpine Linux: mbedtls fixed in 3.6.1-r0
Mbed TLS versions 2.19.0 through 3.6.5 and 4.0.0 allow remote code execution through memory corruption when attackers mo
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows
Same weakness CWE-325 – Missing Cryptographic Step
View allSame technique Authentication Bypass
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| oracular | ignored | end of life, was needs-triage |
| bionic | not-affected | code not present |
| focal | not-affected | code not present |
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| upstream | released | 3.6.4 |
| xenial | not-affected | code not present |
| plucky | ignored | end of life, was needed |
| questing | needed | - |
Debian
Bug #1108787| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | not-affected | - | - |
| bullseye (security) | fixed | 2.16.9-0.1+deb11u3 | - |
| bookworm | not-affected | - | - |
| trixie | fixed | 3.6.5-0.1~deb13u1 | - |
| forky, sid | fixed | 3.6.5-0.1 | - |
| (unstable) | fixed | 3.6.4-1 | - |
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today