CVE-2025-48965: Arm Mbed TLS

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.

Affected products

• Arm Mbed TLS: before 3.6.4 (fixed in 3.6.4)

Published 2025-07-20. Last modified 2026-06-17.