PT-2025-30210 · Mbed Tls+3 · Mbed Tls+3

Linh Le + 1 · Published 2025-01-01 · Updated 2026-05-05 · CVE-2025-48965

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mbedtls versions prior to 3.6.4

Description The software contains a NULL pointer dereference issue in the mbedtls asn1 store named data function. This occurs when conflicting data is triggered with val.p being NULL but val.len being greater than zero.

Recommendations Update to version 3.6.4 or later.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

CWE-696

Related Identifiers

BDU:2025-09512

CVE-2025-48965

DLA-4274-1

USN-8123-1

Affected Products

Debian

Linuxmint

Ubuntu

Mbed Tls

References · 26

• https://security-tracker.debian.org/tracker/CVE-2025-48965 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-48965 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8123-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48965 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-48965 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-48965 · Security Note
• https://osv.dev/vulnerability/USN-8123-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-52496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47917 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-48965 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48965 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-48965 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09512 · Security Note
• https://ubuntu.com/security/CVE-2025-48965 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23775 · Vendor Advisory