What’s Vulnerable › Vulnerabilities

CVE-2025-27810

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-25 · updated 2026-06-17
• Weakness: CWE-908

Description

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

Affected products

• mbedtls: before 2.28.10 — fixed in 2.28.10
• TrustedFirmware Mbed TLS: from 3.0.0 before 3.6.3 — fixed in 3.6.3

How to fix

Upgrade to a fixed version: mbedtls 2.28.10; TrustedFirmware Mbed TLS 3.6.3. Check the vendor advisory for mitigations.

References

• https://github.com/Mbed-TLS/mbedtls/releases
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/

Get alerted when CVE-2025-27810 or the next vulnerability affects your stack