CVE-2025-49601

In MbedTLS 3.3.0 before 3.6.4, mbedtlslmsimportpublickey does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtlslmsimportpublickey allows context-dependent attackers to trigger a crash or limited adjacent-memory disclosure by supplying a truncated LMS (Leighton-Micali Signature) public-key buffer under four bytes. An LMS public key starts with a 4-byte type indicator. The function mbedtlslmsimportpublickey reads this type indicator before validating the size of its input.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49601.json",
    "cna_assigner": "mitre",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.3.0"
                },
                {
                    "fixed": "3.6.4"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.3.0"
                },
                {
                    "fixed": "3.6.4"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "3.3.0"
                },
                {
                    "fixed": "3.6.4"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-125"
    ]
}

References

Affected packages

Git / github.com/mbed-tls/mbedtls

Affected ranges

Type

GIT

Repo

https://github.com/mbed-tls/mbedtls

Events

Introduced

8c89224991adff88d53cd380f42a2baa36f91454

Fixed

c765c831e5c2a0971410692f92f7a81d6ec65ec2

Database specific

{
    "cpe": "cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.6.4"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49601.json"