Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8123-1 advisory.

    It was discovered that Mbed TLS incorrectly handled memory allocation failures. A remote attacker could     possibly use this issue to crash the program. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04     LTS. (CVE-2021-44732)

    Jonathan Winzig discovered that Mbed TLS incorrectly handled crafted inputs. A remote attacker could     possibly use this issue to crash the program, resulting in a denial of service. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS. (CVE-2024-23775)

    It was discovered that Mbed TLS incorrectly handled the TLS handshake. A remote attacker could possibly     use this issue to break the security guarantees of the TLS handshake. (CVE-2025-27810)

    Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly documented the behavior of a function.
    Application code relying on the documented behavior might be affected. A remote attacker could possibly     use this issue to execute arbitrary code. (CVE-2025-47917)

    Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly handled crafted input. A remote attacker     could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2025-48965)

    It was discovered that Mbed TLS incorrectly handled a race condition. An attacker could possibly use this     issue to extract AES keys. (CVE-2025-52496)

    Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly handled certain invalid input. A remote     attacker could possibly use this issue to crash the program, resulting in a denial of service.
    (CVE-2025-52497)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-cbd9bd51dd advisory.

    Add CVE and bug fixes to bundled mbedtls in dolphin-emu

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4274 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4274-2                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     August 30, 2025                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : mbedtls     Version        : 2.16.9-0.1+deb11u3     CVE ID         : CVE-2025-47917

    The previous update, 2.16.9-0.1+deb11u2, fixed the following security issue:

    CVE-2025-47917

        MbedTLS allows use-after-free in certain situations in the correctly         developed applications.

    Unfortunately, the fix was incomplete and introduced a potential regression     in other correctly developed applications.

    For Debian 11 bullseye, this problem has been fixed in version     2.16.9-0.1+deb11u3.

    We recommend that you upgrade your mbedtls packages.

    For the detailed security status of mbedtls please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mbedtls

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in     accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that     is documented as an output argument. The documentation does not suggest that the function will free that     pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which     performs a deep free(). As a result, application code that uses this function (relying only on documented     behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk     of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req     are affected (use-after-free if the san string contains more than one DN). (CVE-2025-47917)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
304014	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Mbed TLS vulnerabilities (USN-8123-1)	Nessus	Ubuntu Local Security Checks	critical
274537	Fedora 42 : dolphin-emu (2025-cbd9bd51dd)	Nessus	Fedora Local Security Checks	critical
251240	Debian dla-4274 : libmbedcrypto3 - security update	Nessus	Debian Local Security Checks	critical
244558	Linux Distros Unpatched Vulnerability : CVE-2025-47917	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-47917

critical

Tenable Plugins

critical

critical

critical

critical