Mbed vulnerabilities
We track 11 vulnerabilities in Mbed products across 3 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on July 20, 2025.
Latest Mbed vulnerabilities
- 9.8 Critical severity
mbedtls: Use After Free
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documen
- 7.5 High severity
mbedtls: NULL Pointer Dereference
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.
- 7.8 High severity
mbedtls: Compiler Optimization Removal or Modification of Security-critical Code
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.
- 7.5 High severity
mbed: Buffer Copy without Checking Size of Input
An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is dete
- 9.8 Critical severity
mbed: Buffer Copy without Checking Size of Input
An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the length of a list of reports by reading a byte from an input stream. It then fetches the length of the first report, uses it to calculate th
- 7.5 High severity
mbed: Buffer Copy without Checking Size of Input
An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. This value is assumed to be greater than or equal to 3, but the software doesn't ensure that this is
- 7.5 High severity
mbed: Buffer Copy without Checking Size of Input
An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet data. A buffer is then allocated to contain the entire packet, the size of which i
- 7.5 High severity
mbed: Integer Overflow or Wraparound
An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet header. A buffer is then allocated to contain the entire packet, the size of which
- 7.5 High severity
mbed: Buffer Copy without Checking Size of Input
An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet header by looking up the identifying first byte and matching it against a table of possible lengths. The initial parsing f
- 9.8 Critical severity
mbedtls: Stack-based Buffer Overflow
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, a
- 8.2 High severity
mbedtls: Improper Access Control
An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.