CVE-2025-52497

What it actually does

One-byte heap-based buffer underflow in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions during PEM parsing of untrusted input, enabling memory corruption.

Why it matters to the business

Applications using Mbed TLS for TLS or cryptographic operations risk denial of service or remote code execution, potentially disrupting secure communications across dependent systems and increasing patch urgency due to library prevalence.

How an attack unfolds

An attacker supplies a specially crafted malicious PEM input to trigger the one-byte underflow in parsing routines, allowing control over adjacent heap memory to achieve code execution or crashes.

How to fix it

Upgrade armmbed/mbedtls to the version containing commit c765c831e5c2a0971410692f92f7a81d6ec65ec2 or Mbed TLS 3.6.4 or newer; rebuild and redeploy all dependent applications.

How to confirm the fix worked

Confirm Mbed TLS version is 3.6.4 or later via build configuration or library metadata; fuzz PEM parsing functions with boundary and malformed inputs to verify absence of underflow.

Typical attack path

1. Identify target application accepting untrusted PEM data such as certificates or keys
2. Craft malicious PEM payload to induce buffer underflow in mbedtls_pem_read_buffer or mbedtls_pk_parse
3. Deliver payload via network, file, or API to trigger parsing
4. Exploit resulting heap state for arbitrary code execution or denial of service

How to detect it

Review application and library logs for segmentation faults or errors originating from mbedtls_pem_read_buffer and mbedtls_pk_parse during PEM processing; correlate with untrusted certificate ingestion events.

• mbedtls_pem_read_buffer
• mbedtls_pk_parse

What your security team should do

• Immediately update Mbed TLS to fixed version across all products and rebuild dependents
• Scan codebases and dependency graphs for Mbed TLS usage to prioritize high-exposure instances
• Add runtime input sanitization for PEM data where feasible until patching completes
• Monitor EPSS trend and re-evaluate exploit maturity as new information emerges