CVE-2025-48965
EUVD-2025-2203120.07.2025, 18:15
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| arm | mbed_tls | 𝑥 < 3.6.4 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| mbed | mbedtls | 𝑥 < 3.6.4 | CNA |
Debian Releases
Common Weakness Enumeration
- CWE-696 - Incorrect Behavior OrderThe product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses.
- CWE-476 - NULL Pointer DereferenceA NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.