CVE-2025-47917

What it actually does

The mbedtls_x509_string_to_names function performs a deep free on its documented output-only head argument via mbedtls_asn1_free_named_data_list, leaving application-held pointers to freed memory and enabling use-after-free or double-free conditions, notably when SAN strings contain multiple DNs in affected sample programs.

Why it matters to the business

Applications relying on Mbed TLS for X.509 certificate processing face elevated risk of crashes, memory corruption, or remote code execution; the presence of public exploit code increases urgency for remediation across dependent projects.

How an attack unfolds

An attacker supplies crafted input containing multiple distinguished names in a subject alternative name string to code paths invoking mbedtls_x509_string_to_names (such as certificate signing or request handling), causing the library to free memory still referenced by the calling application and enabling subsequent use-after-free exploitation for arbitrary code execution.

How to fix it

Upgrade armmbed/mbedtls to the commit c765c831e5c2a0971410692f92f7a81d6ec65ec2 or later; rebuild all dependent applications and verify that custom callers of mbedtls_x509_string_to_names no longer rely on the pre-free pointer value.

How to confirm the fix worked

Confirm the installed commit or release contains c765c831e5c2a0971410692f92f7a81d6ec65ec2; execute the x509/cert_write and x509/cert_req sample programs with multi-DN SAN input and monitor for absence of use-after-free or double-free behavior under memory sanitizers.

Typical attack path

1. Locate applications or libraries built against vulnerable Mbed TLS that invoke mbedtls_x509_string_to_names
2. Craft a certificate or certificate request containing a SAN extension with multiple DNs
3. Trigger certificate generation or parsing code that calls the vulnerable function
4. Reuse or dereference the now-freed memory blocks to achieve code execution or denial of service

How to detect it

Search application logs and crash reports for segmentation faults or memory sanitizer reports occurring during X.509 certificate operations; inspect core dumps or heap traces for double-free or dangling pointer patterns tied to named data list structures.

What your security team should do

• Prioritize upgrade of all Mbed TLS instances to the fixed commit because public exploit code is available
• Audit source code for any direct or indirect use of mbedtls_x509_string_to_names and update callers to allocate fresh structures after the call
• Rebuild and redeploy all affected binaries; re-test certificate handling workflows with memory debugging tools
• Monitor EPSS trend and any new exploit publications for potential increase in in-the-wild activity