PT-2026-29584 · Arm · Mbed Tls

Haruto Kimura + 1 · CVE-2026-25833 · Published 2026-04-01 · Updated 2026-06-22

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 3.5.0 through 3.6.5

Description A buffer overflow exists in the x509 inet pton ipv6() function. This issue was addressed in versions 3.6.6 and 4.1.0.

Recommendations Update to version 3.6.6 or 4.1.0.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-25833

ECHO-BDD6-92E0-39BB

OPENSUSE-SU-2026:10498-1

OPENSUSE-SU-2026:10615-1

OPENSUSE-SU-2026:20875-1

OPENSUSE-SU-2026:21144-1

SUSE-SU-2026:1952-1

SUSE-SU-2026:21440-1

SUSE-SU-2026:21981-1

SUSE-SU-2026:22016-1

Affected Products

Mbed Tls

References · 55

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25833.json · Exploit
• https://osv.dev/vulnerability/ALPINE-CVE-2026-25833 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10498-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25833 · Security Note
• https://ubuntu.com/security/CVE-2026-25833 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25833 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:22016-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10615-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25833 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21144-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25833 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25833 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-inet-pton · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-25833 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories · Vendor Advisory