CVE-2021-44732 — Double Free in ARM Mbed TLS

CWE-415 — Double Free8 documents7 sources
Severity
9.8CRITICALNVD
EPSS
0.9%
top 23.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mbed MbedtlsARM Mbed TLSDebian Linux
Timeline
PublishedDec 20
Latest updateMar 25

Description

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDarm/mbed_tls2.17.0 — 2.28.0+2
▶Debianmbed/mbedtls< 2.16.9-0.1+deb11u1+3
▶Ubuntumbed/mbedtls< 2.8.0-1ubuntu0.1~esm1+3

Also affects: Debian Linux 10.0

🔴Vulnerability Details

4
OSV
mbedtls vulnerabilities↗2026-03-25
▶
GHSA
GHSA-7g56-f7p4-fmcq: Mbed TLS before 3↗2021-12-21
▶
CVEList
CVE-2021-44732: Mbed TLS before 3↗2021-12-20
▶
OSV
CVE-2021-44732: Mbed TLS before 3↗2021-12-20
▶

📋Vendor Advisories

3
Ubuntu
Mbed TLS vulnerabilities↗2026-03-25
▶
Microsoft
Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.↗2021-12-14
▶
Debian
CVE-2021-44732: mbedtls - Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as ...↗2021
▶
CVE-2021-44732 — Double Free in ARM Mbed TLS | cvebase