VULNERABILITY INTELLIGENCE

CVE-2025-27810

CVSS score5.4 MEDIUM
EPSS probability0.30%
CISA KEVNot currently listed
Published2025-03-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Description

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

Weakness classification

  • CWE-908: Use of Uninitialized Resource

Primary references