CVE-2025-47917
BaseFortify
Publication date: 2025-07-20
Last updated on: 2025-11-03
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| arm | mbed_tls | to 3.6.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free issue in Mbed TLS versions before 3.6.4. The function mbedtls_x509_string_to_names() is documented to output data via a pointer argument without freeing it. However, internally, it frees the memory pointed to by this argument, which is unexpected. As a result, applications that rely on the documented behavior may continue to use pointers to memory that has already been freed, leading to use-after-free or double-free errors. This particularly affects sample programs like x509/cert_write and x509/cert_req when the subject alternative name (san) string contains more than one distinguished name (DN).
How can this vulnerability impact me? :
The vulnerability can lead to use-after-free or double-free conditions in applications using Mbed TLS, which can cause crashes, memory corruption, or potentially allow an attacker to execute arbitrary code or cause denial of service. Given the CVSS score of 8.9, it is considered a high severity issue with network attack vector, requiring high attack complexity but no privileges or user interaction. This can impact the stability and security of applications relying on Mbed TLS for cryptographic operations.
What immediate steps should I take to mitigate this vulnerability?
Update Mbed TLS to version 3.6.4 or later, as this version fixes the use-after-free vulnerability in the mbedtls_x509_string_to_names() function. Avoid using affected sample programs such as x509/cert_write and x509/cert_req with SAN strings containing more than one DN until the update is applied.