#VU117336 Covert Timing Channel in mbed TLS - CVE-2025-59438
Published: October 17, 2025
Vulnerability identifier: #VU117336
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2025-59438
CWE-ID: CWE-385
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
mbed TLS
mbed TLS
Software vendor:
ARM
ARM
Description
The vulnerability allows an attacker to perform padding oracle attack.
The vulnerability exists due to padding oracle through timing of cipher error reporting. An attacker can recover plain texts encrypted with CBC-PKCS7 or other symmetric encryption mode using padding when it is decrypted through the PSA API.
Remediation
Install updates from vendor's website.