What is the CVSS score of CVE-2025-52496?

CVE-2025-52496 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by CVE-2025-52496?

Organizations using Mbed TLS before 3.6.4 face notable risk from CVE-2025-52496 rated CVSS 7.8. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2025-52496?

Yes, a public proof-of-concept exploit is available for CVE-2025-52496. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-52496?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Ubuntu CVE-2025-52496

EUVD-2025-20081 HIGH

Compiler Optimization Removal or Modification of Security-critical Code (CWE-733)

2025-07-04 cve@mitre.org

Information Disclosure Debian Ubuntu Mbed Tls Suse Arm

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 25, 2026 - 20:47 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 02:42 euvd

EUVD-2025-20081

Analysis Generated

Mar 16, 2026 - 02:42 vuln.today

PoC Detected

Nov 03, 2025 - 20:19 vuln.today

Public exploit code

CVE Published

Jul 04, 2025 - 15:15 nvd

HIGH 7.8

DescriptionCVE.org

Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.

Analysis

Technical ContextAI

A race condition occurs when the behavior of software depends on the timing of events, such as the order of execution of threads or processes.

RemediationAI

Use proper synchronization mechanisms (locks, mutexes, atomic operations). Implement file locking for filesystem operations. Avoid TOCTOU patterns.

More in Mbed Tls

View all

CVE-2021-44732 CRITICAL Act Now POC

9.8 Dec 20

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_sessi

CVE-2022-35409 CRITICAL Act Now POC

9.1 Jul 15

An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. Rated critical severity (CVSS 9.1), this vulnera

CVE-2017-2784 HIGH This Week POC

8.1 Apr 20

An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before

CVE-2023-45199 CRITICAL Act Now

9.8 Oct 07

Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution. Rated critical sev

CVE-2024-23744 HIGH This Week POC

7.5 Jan 21

An issue was discovered in Mbed TLS 3.5.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n

CVE-2024-49195 CRITICAL Act Now

9.8

Alpine Linux: mbedtls fixed in 3.6.2-r0

CVE-2022-46393 CRITICAL Act Now

9.8 Dec 15

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. Rated critical severity (CVSS 9.8), this vulnera

CVE-2024-45158 CRITICAL Act Now

9.8

Alpine Linux: mbedtls fixed in 3.6.1-r0

CVE-2024-45159 CRITICAL Act Now

9.8

Alpine Linux: mbedtls fixed in 3.6.1-r0

CVE-2026-34877 CRITICAL Act Now

9.8 Apr 02

Mbed TLS versions 2.19.0 through 3.6.5 and 4.0.0 allow remote code execution through memory corruption when attackers mo

CVE-2018-0488 CRITICAL Act Now

9.8 Feb 13

ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows

CVE-2018-0487 CRITICAL Act Now

9.8 Feb 13

ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a

Same weakness CWE-733 – Compiler Optimization Removal or Modification of Security-critical Code

View all

CVE-2025-13024 CRITICAL

9.8

CVE-2020-15294 HIGH

7.0

CVE-2025-20241 HIGH

7.4

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

Ubuntu

Priority: Medium

mbedtls

Release	Status	Version
oracular	ignored	end of life, was needs-triage
bionic	needed	-
focal	needed	-
jammy	needed	-
noble	needed	-
upstream	released	3.6.4
xenial	needed	-
plucky	ignored	end of life, was needed
questing	needed	-

Debian

Bug #1108785

mbedtls

Release	Status	Fixed Version	Urgency
bullseye	fixed	2.16.9-0.1+deb11u2	-
bullseye (security)	fixed	2.16.9-0.1+deb11u3	-
bookworm	vulnerable	2.28.3-1	-
trixie	fixed	3.6.5-0.1~deb13u1	-
forky, sid	fixed	3.6.5-0.1	-
(unstable)	fixed	3.6.4-1	-

DLA-4274-1

SUSE

Severity: High

CVE-2025-52496 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-52496

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Mbed Tls

Same weakness CWE-733 – Compiler Optimization Removal or Modification of Security-critical Code

Same technique Information Disclosure

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code