PT-2025-28010 · Mbed Tls+3 · Mbed Tls+3

Published 2025-06-30 · Updated 2026-05-05 · CVE-2025-52496

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions prior to 3.6.4

Description: The issue is related to a race condition in AESNI detection that can occur under certain compiler optimizations. This could potentially allow an attacker to extract an AES key from a multithreaded program or perform a GCM forgery.

Recommendations: For versions prior to 3.6.4, update to version 3.6.4 or later to resolve the issue. As a temporary workaround, consider disabling multithreading in applications that use Mbed TLS until a patch is applied. Restrict access to sensitive data handled by Mbed TLS to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-733

Related Identifiers

BDU:2025-09517

CVE-2025-52496

DLA-4274-1

USN-8123-1

Affected Products

Debian

Linuxmint

Mbed Tls

Ubuntu

References · 28

• 🔥 https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-1.md · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-52496 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8123-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8123-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-52496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47917 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-48965 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23775 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44732 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-27810 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-52496 · Security Note
• https://ubuntu.com/security/CVE-2025-52497 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-52496 · Vendor Advisory