CVE-2025-48965 MEDIUM

CVE-2025-48965

Vendor Mbed

Product mbedtls

Weakness CWE-696

Published July 20, 2025

Last update November 3, 2025

View on NVD All CVEs

CVSS base score

4.0/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L

What the vulnerability does

01Description

Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.

Key dates

02Disclosure timeline

July 20, 2025 CVE published

November 3, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-48965 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/696.html

Related vulnerabilities

04Related CVE

CVE-2026-35636 OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution CVE-2024-30389 Junos OS: EX4300 Series: Firewall filter not blocking egress traffic CVE-2026-33305 OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor CVE-2023-33224 SolarWinds Platform Incorrect Behavior Order Vulnerability CVE-2026-49317 Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot