CVE-2025-52497: Medium severity Arm mbed TLS vulnerability
Published Jul 4, 2025
·Updated
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtlspemreadbuffer and two mbedtlspkparse functions, via untrusted PEM input.
Affected Software
2 affected components
Arm mbed TLS<3.6.4
Arm mbed TLS<3.6.4
Event History
Jul 4, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-52497?
CVE-2025-52497 is classified as a high-severity vulnerability due to its potential to lead to heap-based buffer underflows.
2
How do I fix CVE-2025-52497?
To fix CVE-2025-52497, upgrade to Mbed TLS version 3.6.4 or later.
3
What type of vulnerability is CVE-2025-52497?
CVE-2025-52497 is a heap-based buffer underflow vulnerability found in Mbed TLS.
4
Which versions of Mbed TLS are affected by CVE-2025-52497?
CVE-2025-52497 affects Mbed TLS versions prior to 3.6.4.
5
What functions are involved in CVE-2025-52497?
CVE-2025-52497 involves the mbedtls_pem_read_buffer and two mbedtls_pk_parse functions.