PT-2025-12765 · Mbed Tls+5 · Mbed Tls+5

Published 2025-03-24 · Updated 2026-05-05 · CVE-2025-27810

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.28.9 and earlier, 3.x versions prior to 3.6.3

Description The issue arises when Mbed TLS, in certain cases of failed memory allocation or hardware errors, utilizes uninitialized stack memory to compose the TLS Finished message. This could potentially lead to authentication bypasses, such as replays.

Recommendations For versions 2.28.9 and earlier, update to version 2.28.10 or later. For 3.x versions prior to 3.6.3, update to version 3.6.3 or later.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

ALT-PU-2025-4727

BDU:2025-06868

CVE-2025-27810

EUVD-2025-14831

JLSEC-2025-187

OPENSUSE-SU-2025:14928-1

USN-8123-1

Affected Products

Alt Linux

Debian

Linuxmint

Mbed Tls

Red Os

Ubuntu

References · 35

• https://ubuntu.com/security/notices/USN-8123-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27810 · Security Note
• https://ubuntu.com/security/CVE-2025-52497 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-27810 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-27810 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-27810 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47917 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-27810 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27810 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44732 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8123-1 · Vendor Advisory