A buffer overflow vulnerability in Mbed TLS 3.5.0 through 3.6.5 allows unauthenticated remote attackers to trigger a denial of service condition.

This is a buffer overflow flaw located within the x509_inet_pton_ipv6 function. An unauthenticated attacker can exploit this via network vectors to cause a service disruption through memory corruption.

Successful exploitation of this vulnerability results in a denial of service, which can significantly impact the availability of systems relying on Mbed TLS for secure communications. With a CVSS score of 7.5, the risk is considered High, particularly for infrastructure components where uptime and service continuity are critical for business operations.

Immediate Action: Upgrade Mbed TLS to version 3.6.6 or 4.1.0 immediately to incorporate the necessary memory safety patches.

Proactive Monitoring: Monitor system logs for unexpected crashes or service restarts that may indicate attempted exploitation of memory corruption vulnerabilities.

Compensating Controls: While no direct WAF rule can prevent all buffer overflows, ensure that network traffic is inspected for malformed IPv6 packets that could trigger the vulnerable function.

Public Exploit Available: No

Given the potential for remote denial of service and the high CVSS rating, organizations should prioritize updating all instances of Mbed TLS 3.5.x to the patched versions. Verification of the software bill of materials is recommended to ensure all embedded or bundled instances of the library are identified and updated.