Is CVE-2025-49601 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-49601 being exploited in the wild.

How severe is CVE-2025-49601?

Medium severity, with a CVSS score of 4.8, published 4 July 2025.

Is there a fix for CVE-2025-49601?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-49601 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-49601?

Check whether you run Arm Mbed Tls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-49601: Mbed TLS out-of-bounds read in mbedtls_lms_import_public_key

CVE-2025-49601 · Severity: medium · CVSS 4.8 · Published 2025-07-04

Mbed TLS is a widely used security library that provides encryption and secure communication for embedded devices. A flaw in how it handles certain digital signature keys could allow an attacker to cause a system crash or potentially view a very small amount of internal memory. This could lead to a temporary service outage for the affected device, though it does not allow for full system takeover.

Technologies: Arm Mbed Tls. Vendors: Arm.

Quick answers

Is CVE-2025-49601 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-49601 being exploited in the wild.
How severe is CVE-2025-49601?: Medium severity, with a CVSS score of 4.8, published 4 July 2025.
Which products and versions are affected?: Arm Mbed Tls 3.3.0 to 3.6.3.
Is there a fix for CVE-2025-49601?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-49601 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-49601?: Check whether you run Arm Mbed Tls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read (CWE-125) exists in the mbedtls_lms_import_public_key() function. The root cause is a failure to validate that the input buffer is at least 4 bytes long before attempting to read a 32-bit type indicator field. An attacker can exploit this by providing a truncated LMS public key buffer (fewer than 4 bytes). This results in a buffer overread of up to 4 bytes, which can lead to undefined behavior, typically manifesting as a crash (DoS) or the leakage of whether adjacent memory matches specific fixed values. The vulnerability is present in Mbed TLS versions 3.3.0 through 3.6.3 and is fixed in version 3.6.4.

Affected products

Arm Mbed TLS 3.3.0 to 3.6.3
TrustedFirmware Mbed TLS 3.3.0 to 3.6.3

Timeline

2025-06-30: advisory: Vendor security advisory released
2025-07-04: disclosed: CVE published

References

https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-4.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.