PT-2025-28011 · Mbed Tls+3 · Mbed Tls+3

Published 2025-06-30 · Updated 2026-05-05 · CVE-2025-52497

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions prior to 3.6.4

Description: The issue is related to a PEM parsing one-byte heap-based buffer underflow in Mbed TLS, specifically in the mbedtls pem read buffer and two mbedtls pk parse functions. This occurs when the software processes untrusted PEM input.

Recommendations: For versions prior to 3.6.4, update to version 3.6.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the mbedtls pem read buffer and mbedtls pk parse functions to minimize the risk of exploitation. Avoid using untrusted PEM input until the issue is resolved.

Fix

Weakness Enumeration

CWE-193

Related Identifiers

BDU:2025-09516

CVE-2025-52497

DLA-4274-1

USN-8123-1

Affected Products

Debian

Linuxmint

Mbed Tls

Ubuntu

References · 26

• https://ubuntu.com/security/notices/USN-8123-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-52497 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8123-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-52496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47917 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-52497 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52497 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-52497 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-52497 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09516 · Security Note
• https://ubuntu.com/security/CVE-2025-48965 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23775 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52497 · Security Note
• https://ubuntu.com/security/CVE-2025-27810 · Vendor Advisory