Vulnerability Details CVE-2025-49087
In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padding mode is used.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 62.8%
CVSS Severity
CVSS v3 Score 4.0
References
Products affected by CVE-2025-49087
-
cpe:2.3:a:trustedfirmware:mbed_tls:3.6.1
-
cpe:2.3:a:trustedfirmware:mbed_tls:3.6.2
-
cpe:2.3:a:trustedfirmware:mbed_tls:3.6.3