CVE-2025-32988

What it actually does

Double-free in GnuTLS SAN export logic for otherName entries with invalid type-id OID, caused by asn1_delete_structure() on an unowned node leading to memory corruption or denial of service when the structure is freed again by the caller.

Why it matters to the business

Applications using GnuTLS for TLS or certificate handling may crash or experience memory corruption under attacker-controlled input, disrupting services and requiring emergency patching across a widely deployed library with many downstream dependents.

How an attack unfolds

An attacker supplies a crafted certificate or triggers certificate processing containing a malformed otherName SAN entry through public GnuTLS APIs; the library performs an ownership transfer error during export, resulting in a double-free that can be used for denial of service or potential memory corruption depending on allocator behavior.

How to fix it

Upgrade GnuTLS to the fixed commit 8a36455fd75ce76391cfc00c53213d8b0e1648da or a later release containing the correction; rebuild and redeploy all dependent applications after the update.

How to confirm the fix worked

Confirm the installed GnuTLS version or commit hash includes 8a36455fd75ce76391cfc00c53213d8b0e1648da; run regression tests exercising SAN export paths with malformed otherName entries and verify absence of crashes or corruption.

Typical attack path

1. Identify a target application or service that uses GnuTLS for certificate validation or TLS handshake processing.
2. Craft or obtain a certificate containing an otherName SAN entry with an invalid or malformed type-id OID.
3. Deliver the certificate to the target via a TLS connection or certificate import API call.
4. Trigger the vulnerable export path in GnuTLS, causing the double-free condition.
5. Observe denial of service or attempt to leverage resulting memory corruption for further exploitation.

How to detect it

Inspect application and system logs for segmentation faults, abort signals, or heap corruption messages during TLS handshake or certificate parsing; correlate with inbound connections presenting unusual certificates.

What your security team should do

• Prioritize upgrade of GnuTLS in all environments within the next maintenance window given its broad ecosystem use.
• Scan build pipelines and container images for vulnerable GnuTLS versions and enforce the fixed commit.
• Monitor for application crashes or memory errors during certificate processing as an interim indicator.
• Review certificate validation code paths to ensure they handle malformed input gracefully until patched.