cbcvebase.
CVE-2025-52497
published 2025-07-04

CVE-2025-52497: Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM…

PriorityP422medium4.8CVSS 3.1
AVNACHPRNUINSUCLINAL
EPSS
0.28%
19.4th percentile
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.

Affected

10 ranges
VendorProductVersion rangeFixed in
armmbed_tls< 3.6.43.6.4
debianmbedtls< mbedtls 2.16.9-0.1+deb11u2 (bullseye)mbedtls 2.16.9-0.1+deb11u2 (bullseye)
mbedmbedtls< 3.6.43.6.4
mbedmbedtls>= 0 < 2.16.9-0.1+deb11u22.16.9-0.1+deb11u2
mbedmbedtls>= 0 < 3.6.4-13.6.4-1
mbedmbedtls>= 0 < 3.6.4-13.6.4-1
mbedmbedtls>= 0 < 2.8.0-1ubuntu0.1~esm12.8.0-1ubuntu0.1~esm1
mbedmbedtls>= 0 < 2.16.4-1ubuntu2+esm12.16.4-1ubuntu2+esm1
mbedmbedtls>= 0 < 2.28.0-1ubuntu0.1~esm12.28.0-1ubuntu0.1~esm1
mbedmbedtls>= 0 < 2.28.8-1ubuntu0.1~esm12.28.8-1ubuntu0.1~esm1

CVSS provenance

nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian4.8MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.