CVE Details
Basic Information
| Title | CVE-2025-47917 |
|---|---|
| Type | cve |
| Published | 2025-07-20T00:00:00.000Z |
| Modified | 2025-07-20T18:31:44.021Z |
Product Information
| Vendor | Mbed |
|---|---|
| Product | mbedtls |
| Version | 0 |
CVSS Information
| Base Score | 8.9 (HIGH) |
|---|---|
| Attack Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H |
Affected Products
- Mbed mbedtls 0
Additional Information
| CWE List | CWE-416 |
|---|---|
| Source | mitre |
Description
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).