QSearchQSearch

CVE-2025-27810

5.4 MEDIUM

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memo...

Published: 2025-03-25 · Last updated: 2026-06-05

Severity and scoring

CVSS
5.4 MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
CWE-908

Affected products

VendorProduct
armmbed_tls
trustedfirmwarembed_tls

Description

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-45702 — OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using t... (4.4 MEDIUM)
  • CVE-2026-45614 — OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using t... (4.7 MEDIUM)
  • CVE-2026-40290 — OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using t... (7.8 HIGH)
  • CVE-2026-33662 — OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using t... (7.5 HIGH)
  • CVE-2026-33317 — OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using t... (8.7 HIGH)

Same CWE

  • CVE-2026-42969 — Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally (5.5 MEDIUM)
  • CVE-2026-48104 — 7-Zip is a file archiver with a high compression ratio (4.2 MEDIUM)
  • CVE-2026-48101 — 7-Zip is a file archiver with a high compression ratio (6.5 MEDIUM)
  • CVE-2026-11089 — Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to ... (6.5 MEDIUM)
  • CVE-2026-26825 — A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files (5.3 MEDIUM)