CVE-2025-52496 is a high-severity race condition affecting Mbed TLS versions prior to 3.6.4, specifically concerning AESNI detection under certain compiler optimizations. This flaw could allow an attacker to extract AES keys or perform GCM forgery in multithreaded applications. With a CVSS score of 7.8 (HIGH) and a FAUCET Risk Score of 74/100, the vulnerability requires local access and high attack complexity but has significant confidentiality and integrity impacts. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.6.4CPE matchmatch criteria | cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Mbed TLS vulnerabilities
Mar 25, 2026Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.
Jul 8, 2025