PT-2025-28013 · Mbed Tls · Mbed Tls
Published
2025-06-30
·
Updated
2025-07-04
·
CVE-2025-49601
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
Name of the Vulnerable Software and Affected Versions:
MbedTLS versions 3.3.0 through 3.6.3
Description:
The issue arises from the function
mbedtls lms import public key not checking if the input buffer is at least 4 bytes before reading a 32-bit field. This allows for a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtls lms import public key enables context-dependent attackers to trigger a crash or limited adjacent-memory disclosure by supplying a truncated LMS public-key buffer under four bytes. An LMS public key starts with a 4-byte type indicator, which the function reads before validating the size of its input.Recommendations:
For MbedTLS versions 3.3.0 through 3.6.3, update to version 3.6.4 or later to resolve the issue. As a temporary workaround, consider validating the size of the input buffer to ensure it is at least 4 bytes before calling the
mbedtls lms import public key function.Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mbed Tls