Every CVE Search/ Get API key

CVE-2026-25833

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6...

7.5 HighFix available

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.32%Up 0.3 points since Apr 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

Record
CVE-2026-25833
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-121
Updated
2026-11-02
EUVDEUVD-2026-17997 7.5

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

Record
EUVD-2026-17997
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-jr87-qch5-gjc6 7.5

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6...

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

Record
GHSA-jr87-qch5-gjc6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-121
Updated
2026-11-02
NVD 7.5

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

Record
CVE-2026-25833
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-121
Updated
2026-11-02
OSVALPINE-CVE-2026-25833 7.5

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

Record
ALPINE-CVE-2026-25833
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 7.5

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

Record
CVE-2026-25833
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2026-25833 7.5

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

Record
DEBIAN-CVE-2026-25833
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-25833 7.5

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

Record
UBUNTU-CVE-2026-25833
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10498-1 No score

libeverest-3.6.6-1.1 on GA media

These are all security issues fixed in the libeverest-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10498-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10615-1 No score

ovmf-202602-9.1 on GA media

These are all security issues fixed in the ovmf-202602-9.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10615-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20875-1 No score

Security update for ovmf

This update for ovmf fixes the following issues:

  • CVE-2026-25833: mbedtls: buffer overflow in the x509_inet_pton_ipv6() function (bsc#1261476).
  • CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477).
  • CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478).
  • CVE-2026-34874: mbedtls: NULL pointer dereference in distinguished name parsing (bsc#1261469).
Record
openSUSE-SU-2026:20875-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21144-1 No score

Security update for mbedtls

This update for mbedtls fixes the following issues:

Changes in mbedtls:

  • Update to 3.6.6 (LTS maintenance update from 3.6.1); security fixes accumulated across the 3.6.2-3.6.6 releases:
    • CVE-2024-49195 (boo#1231708): buffer underrun in pkwrite when writing an opaque key pair
    • CVE-2025-27809 (boo#1240051): certificate verification accepted arbitrary hostnames
    • CVE-2025-27810 (boo#1240052): possible authentication bypass on failed memory allocation / hardware errors
    • CVE-2025-47917 (boo#1246783): misleading memory management in mbedtls_x509_string_to_names()
    • CVE-2025-48965 (boo#1246784): NULL pointer dereference after mbedtls_asn1_store_named_data()
    • CVE-2025-49087 (boo#1246973): timing side channel in PKCS#7 padding removal
    • CVE-2025-49600 (boo#1245808): unchecked return values in LMS verification allow signature bypass via fault injection
    • CVE-2025-49601 (boo#1245809): out-of-bounds read in mbedtls_lms_import_public_key()
    • CVE-2025-52496 (boo#1245810): race in AES-NI support detection can lead to AES key extraction or GCM forgery
    • CVE-2025-52497 (boo#1245811): one-byte heap underflow when parsing PEM-encrypted material
    • CVE-2025-54764 (boo#1252341): timing attacks in RSA operations
    • CVE-2025-59438 (boo#1252454): padding-oracle attack via timing of cipher error reporting
    • CVE-2026-25833: PSA RNG state duplicated across fork()
    • CVE-2026-25834: TLS 1.3 HelloRetryRequest man-in-the-middle session-resumption downgrade
    • CVE-2026-25835: RNG state duplicated when application/VM state is cloned
Record
openSUSE-SU-2026:21144-1
Updated
2026-11-02
OSVSUSE-SU-2026:1952-1 No score

Security update for ovmf

This update for ovmf fixes the following issues

  • CVE-2026-25833: mbedtls: buffer underflow in x509_inet_pton_ipv6() (bsc#1261476).
  • CVE-2026-25834: mbedtls: Algorithm downgrade vulnerability (bsc#1261477).
  • CVE-2026-25835: mbedtls: PSA random generator cloning (bsc#1261478).
  • CVE-2026-34874: mbedtls: NULL pointer dereference when setting a distinguished name (bsc#1261469).

Changes for ovmf:

  • Update mbedtls to 3.6.6.
Record
SUSE-SU-2026:1952-1
Updated
2026-11-02
OSVSUSE-SU-2026:21440-1 No score

Security update for ovmf

This update for ovmf fixes the following issues:

  • CVE-2026-25833: mbedtls: buffer overflow in the x509_inet_pton_ipv6() function (bsc#1261476).
  • CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477).
  • CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478).
  • CVE-2026-34874: mbedtls: NULL pointer dereference in distinguished name parsing (bsc#1261469).
Record
SUSE-SU-2026:21440-1
Updated
2026-11-02
OSVSUSE-SU-2026:21981-1 No score

Security update for ovmf

This update for ovmf fixes the following issues:

  • CVE-2026-25833: mbedtls: buffer overflow in the x509_inet_pton_ipv6() function (bsc#1261476).
  • CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477).
  • CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478).
  • CVE-2026-34874: mbedtls: NULL pointer dereference in distinguished name parsing (bsc#1261469).
Record
SUSE-SU-2026:21981-1
Updated
2026-11-02
OSVSUSE-SU-2026:22016-1 No score

Security update for ovmf

This update for ovmf fixes the following issues:

  • CVE-2026-25833: mbedtls: buffer overflow in the x509_inet_pton_ipv6() function (bsc#1261476).
  • CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477).
  • CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478).
  • CVE-2026-34874: mbedtls: NULL pointer dereference in distinguished name parsing (bsc#1261469).
Record
SUSE-SU-2026:22016-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mbedtls
Alpine:v3.20
 before 3.6.6-r0
3.6.6-r0
mbedtls
Alpine:v3.21
 before 3.6.6-r0
3.6.6-r0
mbedtls
Alpine:v3.22
 before 3.6.6-r0
3.6.6-r0
mbedtls
Alpine:v3.23
 before 3.6.6-r0
3.6.6-r0
mbedtls
Alpine:v3.24
 before 3.6.6-r0
3.6.6-r0
mbedtls3
Alpine:v3.24
 before 3.6.6-r0
3.6.6-r0
mbedtls
Debian:12
 All versions, plus listed versions
2.28.3-12.28.4-12.28.5-12.28.6-12.28.7-1
Show 18 moreShow less
2.28.7-1.12.28.7-1.1~exp12.28.8-13.6.0-13.6.0-23.6.0-33.6.2-13.6.2-23.6.2-33.6.3-13.6.4-13.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.13.6.6-0.1~deb13u13.6.7-23.6.7-3
 None known
mbedtls
Debian:13
 All versions, plus listed versions
3.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.13.6.6-0.1~deb13u13.6.7-23.6.7-3
 None known
mbedtls
Debian:14
 before 3.6.6-0.1, plus listed versions
3.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.1~deb13u1
3.6.6-0.1
ovmf
SUSE:Linux Enterprise Server 16.0
 before 202502-160000.5.1
202502-160000.5.1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
ovmf
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 202502-160000.5.1
202502-160000.5.1
mbedtls
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.1.2-12.2.0-12.2.1-12.2.1-22.2.1-2ubuntu0.12.2.1-2ubuntu0.22.2.1-2ubuntu0.3
 None known
mbedtls
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.5.1-1ubuntu12.6.0-12.7.0-22.8.0-12.8.0-1ubuntu0.1~esm1
 None known
mbedtls
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.16.2-12.16.3-12.16.4-1ubuntu22.16.4-1ubuntu2+esm1
 None known
mbedtls
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.16.9-0.1ubuntu12.16.11-0.1ubuntu12.16.11-0.32.28.0-12.28.0-1build12.28.0-1ubuntu0.1~esm1
 None known
mbedtls
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.28.3-12.28.6-1ubuntu12.28.7-1ubuntu12.28.7-1.1ubuntu12.28.8-12.28.8-1ubuntu0.1~esm1
 None known
mbedtls
Ubuntu:25.10
 All versions, plus listed versions
3.6.2-3ubuntu1
 None known
mbedtls
Ubuntu:26.10
 All versions, plus listed versions
3.6.5-0.1ubuntu23.6.6-0.1ubuntu13.6.7-3ubuntu1
 None known
mbedtls
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.6.2-3ubuntu13.6.5-0.1ubuntu13.6.5-0.1ubuntu2
 None known
mbedtls
openSUSE:Tumbleweed
 before 3.6.6-1.1
3.6.6-1.1
ovmf
openSUSE:Tumbleweed
 before 202602-9.1
202602-9.1
mbedtls
openSUSE:Leap 16.0
 before 3.6.6-bp160.1.1
3.6.6-bp160.1.1

History

History
RecordedChangedSources
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-25833 is a high vulnerability (CVSS 7.5) in Trustedfirmware Mbed Tls, published April 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in mbedtls 3.6.6-r0.

References

Show 45 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open