CVE-2025-48965
BaseFortify
Publication date: 2025-07-20
Last updated on: 2025-11-03
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| arm | mbed_tls | to 3.6.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-696 | The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses. |
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Mbed TLS versions before 3.6.4 is a NULL pointer dereference caused by the function mbedtls_asn1_store_named_data. It can occur when the function processes conflicting data where the pointer val.p is NULL but the length val.len is greater than zero, potentially leading to a crash or denial of service.
How can this vulnerability impact me? :
The vulnerability can cause a denial of service by crashing the application using the affected Mbed TLS library due to a NULL pointer dereference. This may disrupt services relying on the library but does not impact confidentiality or integrity.