CVE-2025-49601: Mbed TLS Information Disclosure Flaw

CVE-2025-49601 Overview

CVE-2025-49601 is an out-of-bounds read vulnerability in Mbed TLS versions 3.3.0 through 3.6.3. The function mbedtls_lms_import_public_key reads a 32-bit type indicator from the input buffer before validating that the buffer is at least 4 bytes long. A context-dependent attacker can supply a truncated Leighton-Micali Signature (LMS) public key to trigger a crash or disclose limited adjacent memory. The flaw is classified as [CWE-125] Out-of-Bounds Read.

Critical Impact
Attackers supplying a truncated LMS public key under four bytes can crash the process or read adjacent heap memory, impacting confidentiality and availability in applications that accept untrusted LMS public keys.

Affected Products

Trusted Firmware Mbed TLS 3.3.0 through 3.6.3
Applications linking libmbedcrypto and exposing mbedtls_lms_import_public_key to untrusted input
Embedded and IoT firmware using post-quantum LMS signature verification via Mbed TLS

Discovery Timeline

2025-07-04 - CVE-2025-49601 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49601

Vulnerability Analysis

Mbed TLS implements the Leighton-Micali Signature (LMS) stateful hash-based signature scheme as defined in RFC 8554. An LMS public key begins with a 4-byte type indicator that identifies the LMS algorithm parameters. The function mbedtls_lms_import_public_key reads this 32-bit field from the caller-supplied buffer before checking whether the buffer contains at least four bytes of data.

When an attacker provides a buffer shorter than four bytes, the read extends past the allocated region. Depending on allocator behavior and adjacent memory contents, the process may crash or return type-indicator bytes derived from unrelated memory. The resulting behavior falls under [CWE-125] Out-of-Bounds Read.

Root Cause

The root cause is a missing length check before a fixed-width field read. The implementation validates the type indicator against expected values but performs the read prior to size validation. Standard defensive coding requires validating input length before dereferencing any structured field.

Attack Vector

Exploitation requires that an application pass attacker-controlled data to mbedtls_lms_import_public_key. Typical exposure includes TLS handshakes, firmware update verifiers, and signature-parsing services that accept untrusted LMS keys over a network. The attacker does not need authentication or user interaction. Successful triggering yields either a denial-of-service crash or narrow adjacent-memory disclosure limited to a few bytes.

The vulnerability manifests entirely within the input-parsing preamble of the LMS import routine. See the GitHub Security Advisory for the upstream technical description and patch reference.

Detection Methods for CVE-2025-49601

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libmbedcrypto when handling LMS keys
Log entries showing malformed LMS public-key inputs shorter than four bytes
Repeated failed signature-verification attempts originating from a single network source

Detection Strategies

Inventory binaries linking Mbed TLS versions 3.3.0 through 3.6.3 using software composition analysis tools
Enable AddressSanitizer or Valgrind in test environments to catch out-of-bounds reads in mbedtls_lms_import_public_key
Deploy network monitoring rules that flag truncated LMS key structures presented to signature-verification endpoints

Monitoring Recommendations

Monitor process crash telemetry and core dumps for services that parse LMS public keys
Aggregate libmbedcrypto version data across the fleet and alert on unpatched instances
Track anomalous signature-verification failure rates against firmware update and TLS services

How to Mitigate CVE-2025-49601

Immediate Actions Required

Upgrade Mbed TLS to version 3.6.4 or later across all affected systems and dependent products
Identify third-party and embedded products bundling vulnerable Mbed TLS builds and request vendor updates
Restrict exposure of LMS public-key import functionality to authenticated or trusted callers where feasible

Patch Information

The Mbed TLS maintainers fixed the issue in version 3.6.4 by validating the input buffer length before reading the 4-byte type indicator in mbedtls_lms_import_public_key. Details are available in the Mbed TLS Security Advisory 2025-06-4. Rebuild and redeploy any application statically linking the affected library.

Workarounds

Add a caller-side length check rejecting LMS public-key buffers shorter than four bytes before invoking mbedtls_lms_import_public_key
Disable LMS signature verification paths in applications that do not require post-quantum signatures
Terminate untrusted LMS parsing behind an input-validation proxy that enforces minimum key-size constraints

bash

# Verify installed Mbed TLS version and upgrade
pkg-config --modversion mbedtls
# Expected output: 3.6.4 or later

# Rebuild from source at the fixed tag
git clone https://github.com/Mbed-TLS/mbedtls.git
cd mbedtls
git checkout v3.6.4
mkdir build && cd build
cmake .. && make && sudo make install