Arm: >> Mbed Tls >> 4.0.0 Security Vulnerabilities
An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.
CVSS Score
9.8
EPSS Score
0.002
Published
2026-04-02
An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.
CVSS Score
7.5
EPSS Score
0.001
Published
2026-04-01
Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function
CVSS Score
7.5
EPSS Score
0.0
Published
2026-04-01
Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
CVSS Score
7.7
EPSS Score
0.0
Published
2026-04-01
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
CVSS Score
6.5
EPSS Score
0.0
Published
2026-04-01