Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mbedtlsUpgrade mbedtls3 | Aug 8, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade mbedtls | Jul 7, 2025 | Jul 4, 2025 |
| Ubuntu | — | Upgrade libmbedcrypto3 (Ubuntu Pro)Upgrade libmbedtls12 (Ubuntu Pro)Upgrade libmbedtls10 (Ubuntu Pro)Upgrade libmbedx509-1t64 (Ubuntu Pro)Upgrade libmbedtls-dev (Ubuntu Pro)Upgrade libmbedtls14t64 (Ubuntu Pro)Upgrade libmbedx509-0 (Ubuntu Pro)Upgrade libmbedcrypto7t64 (Ubuntu Pro)Upgrade libmbedcrypto7 (Ubuntu Pro)Upgrade libmbedx509-1 (Ubuntu Pro)Upgrade libmbedtls14 (Ubuntu Pro)Upgrade libmbedcrypto1 (Ubuntu Pro) | Mar 27, 2026 | Mar 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub