Skip to main content
HIGH

CVE-2025-47917

CVSS v3

8.9

HIGH

EPSS Score

2.3 %

exploit probability, as of 2026-10-18

CISA KEV

No

known exploited

Exploitation

none

SSVC status

Get an alert for each new CVE published for mbedtls.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

  • CVE-2025-47917 Red Hat Product Security

    mbedtls: Mbed TLS Use-After-Free Vulnerability

Full record on NVD

Description

Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
Published
2025-07-20
Last Modified
2025-11-03
Exploit-DB
EDB-52427

Frequently asked questions

What is CVE-2025-47917?

Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).

Is CVE-2025-47917 actively exploited?

Active exploitation of CVE-2025-47917 has not been confirmed. Its EPSS score was 2.3% on 2026-10-18, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-47917?

CVE-2025-47917 has a CVSS v3 base score of 8.9 (HIGH severity), with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H.

Running mbedtls? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, October 2026Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database