Use-After-Free Vulnerability in Mbed TLS: CVE-2025-47917
Summary
CVE-2025-47917: Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. Affects mbedtls across 2 version ranges.
< 3.6.4-r0
< c765c831e5c2a0971410692f92f7a81d6ec65ec2
Fixed in 3.6.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mbed TLS is a widely used cryptographic library designed to facilitate secure communication in embedded systems and IoT devices. It provides essential functionalities such as SSL/TLS support, cryptographic algorithms, and certificate management. However, the library has been found to have a critical vulnerability that can lead to severe security issues if not addressed promptly.
Vulnerability Detail
The vulnerability identified as CVE-2025-47917 is a use-after-free issue that affects Mbed TLS versions prior to 3.6.4. This flaw arises in the function mbedtls_x509_string_to_names(), which is intended to convert a string representation of X.509 names into a structured format. The function incorrectly frees the memory pointed to by its output argument, leading to potential use-after-free or double-free scenarios. Applications that rely on the documented behavior of this function may inadvertently access freed memory, resulting in undefined behavior, crashes, or security breaches. The vulnerability particularly impacts applications that utilize the sample programs x509/cert_write and x509/cert_req when the Subject Alternative Name (SAN) string contains multiple Distinguished Names (DNs).
How To Fix
Minimum fixed version
3.6.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade mbedtlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers are advised to review their application code to ensure that they do not access the memory pointed to by the output argument after calling mbedtls_x509_string_to_names(). This may involve implementing additional checks or modifying how the function is used to avoid relying on the freed memory.
Conclusion
The CVE-2025-47917 vulnerability in Mbed TLS poses significant risks due to its use-after-free nature. It is crucial for developers to update to the patched version 3.6.4 or later to mitigate these risks. Additionally, reviewing application code for safe memory access is recommended until an update can be applied.
See every vulnerability recorded for mbedtls →
FAQ
CVE-2025-47917 is a use-after-free vulnerability in Mbed TLS that can lead to security risks if exploited.
Versions of Mbed TLS prior to 3.6.4 are affected by this vulnerability.
Exploitation of this vulnerability can lead to application crashes, undefined behavior, or security breaches due to access to freed memory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, review your application code to avoid accessing freed memory and consider implementing additional checks.
References
Related vulnerabilities
Recent vulnerabilities recorded for mbedtls.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
