EUVD-2025-20082Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Off-by-one prevention
|
| Impact | CVSS 4.8. EPSS 0.1%. Vendor patch available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability in Mbed TLS before 3.6.4 to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
A security vulnerability in Mbed TLS before 3.6.4 (CVSS 4.8). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Earlier versions of this analysis (1)
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
RemediationAI
Apply the vendor-supplied patch immediately.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vulnerability type not specified by vendor. Affects Mbed TLS before 3.6.4.
Know when Mbed Tls gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
Executive ViewAI
Organizations using Mbed TLS before 3.6.4 should be aware of moderate risk from CVE-2025-52497 rated CVSS 4.8. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_sessi
An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. Rated critical severity (CVSS 9.1), this vulnera
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may b
Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution. Rated critical sev
An issue was discovered in Mbed TLS 3.5.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
Alpine Linux: mbedtls fixed in 3.6.2-r0
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. Rated critical severity (CVSS 9.8), this vulnera
Alpine Linux: mbedtls fixed in 3.6.1-r0
Alpine Linux: mbedtls fixed in 3.6.1-r0
Mbed TLS versions 2.19.0 through 3.6.5 and 4.0.0 allow remote code execution through memory corruption when attackers mo
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows
Same weakness CWE-193 – Off-by-one Error
View allSame technique Information Disclosure
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| oracular | ignored | end of life, was needs-triage |
| bionic | needed | - |
| focal | needed | - |
| jammy | needed | - |
| noble | needed | - |
| upstream | released | 3.6.4 |
| xenial | needed | - |
| plucky | ignored | end of life, was needed |
| questing | needed | - |
Debian
Bug #1108786| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2.16.9-0.1+deb11u2 | - |
| bullseye (security) | fixed | 2.16.9-0.1+deb11u3 | - |
| bookworm | vulnerable | 2.28.3-1 | - |
| trixie | fixed | 3.6.5-0.1~deb13u1 | - |
| forky, sid | fixed | 3.6.5-0.1 | - |
| (unstable) | fixed | 3.6.4-1 | - |
Exploit-DB