PT-2025-30212 · Mbed Tls+3 · Mbed Tls+3

Published 2025-01-01 · Updated 2026-05-05 · CVE-2025-47917

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mbedtls versions prior to 3.6.4

Description The software contains a use-after-free issue in the mbedtls x509 string to names() function. This function incorrectly frees a pointer that application code may still be using, leading to a potential use-after-free or double-free condition. The sample programs cert write and cert req are affected when the Subject Alternative Name (SAN) string contains more than one Distinguished Name (DN).

Recommendations Update to mbedtls version 3.6.4 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-09513

CVE-2025-47917

DLA-4274-1

DLA-4274-2

USN-8123-1

Affected Products

Debian

Linuxmint

Ubuntu

Mbed Tls

References · 32

• 🔥 https://exploit-db.com/exploits/52427 · Exploit
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-47917 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8123-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8123-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-52496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47917 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-47917 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-48965 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23775 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44732 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09513 · Security Note
• https://ubuntu.com/security/CVE-2025-27810 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-52497 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4274-1 · Vendor Advisory