HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2025-52496

CVSS 7.8v3.1pub. 2025-07-04upd. 2025-11-03

Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

  • Arm Mbed Tls

    APP
    Arm
    < 3.6.4
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Race Condition
CWE
References

Related vulnerabilities

CVE-2026-34877CRITICAL9.8PL ✓same product

RCE przez deserializację kontekstu SSL w Mbed TLS

CVE-2026-34872CRITICAL9.1PL ✓same product

Brak weryfikacji wkładu strony w FFDH w Mbed TLS i TF-PSA-Crypto

CVE-2022-46393CRITICAL9.8PL ✓same product

Przepełnienie bufora sterty w Mbed TLS — DTLS Connection ID

CVE-2022-35409CRITICAL9.1PL ✓same product

Mbed TLS: heap buffer over-read w obsłudze DTLS ClientHello

CVE-2021-44732CRITICAL9.8PL ✓same product

Double free w Mbed TLS przy błędach braku pamięci (RCE/DoS)