Known vulnerabilities in mbed TLS

Vendor: ARM
Software: mbed TLS
Software CPE: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*
Total vulnerabilities: 55
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting mbed TLS mbed TLS is affected by 55 known vulnerabilities: 6 high, 28 medium, 21 low Critical High Medium Low

Vulnerabilities (55)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137396 - Improper input validation
CVE-2026-54434
CWE-20 Medium
No
No
4.1.0, 4.1.1 13.07.2026 SB2026071347
#VU137395 - Information Exposure Through Timing Discrepancy
CVE-2026-54435
CWE-208 Low
No
No
3.6.7, 4.1.1, 4.2.0 13.07.2026 SB2026071347
#VU137394 - Memory corruption
CVE-2026-50584
CWE-119 Medium
No
No
3.6.7, 4.1.1, 4.2.0 13.07.2026 SB2026071347
#VU124854 - Information Exposure Through Timing Discrepancy
CVE-2025-66442
CWE-208 Low
No
No
- 02.04.2026 -
#VU124853 - Insufficient Verification of Data Authenticity
CVE-2026-34877
CWE-345 Medium
No
No
3.6.6, 4.1.0 02.04.2026 SB2026040204
#VU124810 - Out-of-bounds read
CVE-2026-34876
CWE-125 Medium
No
No
3.6.6, 4.0.0 02.04.2026 SB2026040204
#VU124809 - Improper Access Control
CVE-2026-25834
CWE-284 Medium
No
No
3.6.6, 4.1.0 02.04.2026 SB2026040204
SB20260427166
SB20260427167
and 3 more
#VU124808 - Use of Insufficiently Random Values
CVE-2026-25835
CWE-330 Low
No
No
3.6.6, 4.1.0 02.04.2026 SB2026040204
SB2026040205
SB2026040277
and 7 more
#VU124807 - NULL Pointer Dereference
CVE-2026-34874
CWE-476 Medium
No
No
3.6.6, 4.1.0 02.04.2026 SB2026040204
SB2026040277
SB2026040278
and 3 more
#VU124806 - Buffer Underwrite ('Buffer Underflow')
CVE-2026-25833
CWE-124 Medium
No
No
3.6.6, 4.1.0 02.04.2026 SB2026040204
SB2026040277
SB2026040278
and 3 more
#VU124805 - Improper input validation
CVE-2026-34872
CWE-20 Medium
No
No
3.6.6 02.04.2026 SB2026040204
SB2026040205
SB20260427166
and 2 more
#VU124804 - Buffer overflow
CVE-2026-34875
CWE-120 High
No
No
3.6.6 02.04.2026 SB2026040204
SB2026040205
SB20260427166
and 2 more
#VU124803 - Use of Insufficiently Random Values
CVE-2026-34871
CWE-330 Low
No
No
3.6.6 02.04.2026 SB2026040204
SB2026040205
SB2026040277
and 6 more
#VU124802 - Improper Authentication
CVE-2026-34873
CWE-287 Medium
No
No
3.6.6, 4.1.0 02.04.2026 SB2026040204
SB2026040277
SB2026040278
and 4 more
#VU117337 - Covert Timing Channel
CVE-2025-54764
CWE-385 Medium
No
No
3.6.5 17.10.2025 SB2025101717
SB2025101718
SB2025101719
and 4 more
#VU117336 - Covert Timing Channel
CVE-2025-59438
CWE-385 Medium
No
No
3.6.5 17.10.2025 SB2025101717
SB2025101718
SB2025101719
and 9 more
#VU112444 - Out-of-bounds read
CVE-2025-52497
CWE-125 Medium
No
No
3.6.4 07.07.2025 SB2025070782
SB2025070784
SB2025070785
and 3 more
#VU112443 - Covert Timing Channel
CVE-2025-49087
CWE-385 Medium
No
No
3.6.4 07.07.2025 SB2025070782
SB2026012742
#VU112442 - NULL Pointer Dereference
CVE-2025-48965
CWE-476 Medium
No
No
3.6.4 07.07.2025 SB2025070782
SB2025110101
SB2026033149
#VU112441 - Use After Free
CVE-2025-47917
CWE-416 High
No
No
3.6.4 07.07.2025 SB2025070782
SB2025110101
SB2026033149


Showing elements 1 - 20 out of 55