# CVE-2025-49600: Mbed TLS signature bypass in LMS verification

Source: https://junglewise.ai/threats/cve-2025-49600-mbed-tls-signature-bypass-in-lms-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-04. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-49600 · Severity: medium · CVSS 4.9 · Published 2025-07-04

Mbed TLS is a widely used library that provides cryptographic and SSL/TLS capabilities for embedded devices. A vulnerability in its signature verification process could allow an attacker with physical access to the device to bypass security checks. By interfering with the device's hardware during a calculation, an attacker could trick the system into accepting a forged digital signature, potentially allowing unauthorized software or commands to be executed.

## Quick answers

**Is CVE-2025-49600 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-49600 being exploited in the wild.

**How severe is CVE-2025-49600?** Medium severity, with a CVSS score of 4.9, published 4 July 2025.

**Which products and versions are affected?** TrustedFirmware Mbed TLS 3.3.0 to 3.6.3.

**Is there a fix for CVE-2025-49600?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-49600 attacked?** It is attacked with physical access, in a software library.

**Am I affected by CVE-2025-49600?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the mbedtls_lms_verify() function due to unchecked return values from internal Merkle tree functions, specifically create_merkle_leaf_value() and create_merkle_internal_value(). When hardware-accelerated hashing is used, an attacker can use physical fault injection to cause these functions to fail. Because the return values are not validated, the output buffer (Tc_candidate_root_node) may remain uninitialized or contain stale data from a previous successful verification. This allows an attacker to bypass signature verification by reusing valid root node data remaining on the stack. The issue is resolved in Mbed TLS 3.6.4.

## Affected products

- TrustedFirmware Mbed TLS 3.3.0 to 3.6.3

## Timeline

- 2025-06-30: advisory: Original security advisory date
- 2025-07-04: disclosed: NVD publication date

## References

- [https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-3.md](https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-3.md)