CVE-2025-47917

Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).

• CWE-416

• https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-7.mdMitigation, Third Party Advisory
• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html
• https://lists.debian.org/debian-lts-announce/2025/08/msg00025.html

Published

Jul 20, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-47911The html.Parse function in golang.org/x/net/html has quadrat…5.3
• CVE-2025-47912The Parse function permits values other than IPv6 addresses …5.3
• CVE-2025-47913SSH clients receiving SSH_AGENT_SUCCESS when expecting a typ…7.5
• CVE-2025-47914SSH Agent servers do not validate the size of messages when …5.3
• CVE-2025-47915Rejected reason: reserved but not needed
• CVE-2025-47916Invision Community 5.0.0 before 5.0.7 allows remote code exe…9.8
• CVE-2025-4792A vulnerability was found in FreeFloat FTP Server 1.0 and cl…9.8
• CVE-2025-47928Spotipy is a Python library for the Spotify Web API. As of c…9.1
• CVE-2025-47929DumbDrop, a file upload application that provides an interfa…2.1
• CVE-2025-4793A vulnerability was found in PHPGurukul Online Course Regist…9.8
• CVE-2025-47930Zulip is an open-source team chat application. Starting in v…5.3
• CVE-2025-47931LibreNMS is PHP/MySQL/SNMP based network monitoring software…6.1