EUVD-2025-20082CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Lifecycle Timeline
4DescriptionNVD
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
AnalysisAI
A security vulnerability in Mbed TLS before 3.6.4 (CVSS 4.8). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Technical ContextAI
Vulnerability type not specified by vendor. Affects Mbed TLS before 3.6.4.
RemediationAI
Apply the vendor-supplied patch immediately.
More from same product – last 7 days
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers
Authentication-context bypass in pam_usb before 0.9.0 lets a person holding an enrolled USB device authenticate over SSH
pam_usb prior to 0.9.0 crashes under memory pressure due to assert()-based OOM guards in src/mem.c that are silently str
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removin
In the Linux kernel, the following vulnerability has been resolved: ksmbd: call ksmbd_vfs_kern_path_end_removing() on s
Vendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| oracular | ignored | end of life, was needs-triage |
| bionic | needed | - |
| focal | needed | - |
| jammy | needed | - |
| noble | needed | - |
| upstream | released | 3.6.4 |
| xenial | needed | - |
| plucky | ignored | end of life, was needed |
| questing | needed | - |
Debian
Bug #1108786| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2.16.9-0.1+deb11u2 | - |
| bullseye (security) | fixed | 2.16.9-0.1+deb11u3 | - |
| bookworm | vulnerable | 2.28.3-1 | - |
| trixie | fixed | 3.6.5-0.1~deb13u1 | - |
| forky, sid | fixed | 3.6.5-0.1 | - |
| (unstable) | fixed | 3.6.4-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today