A double-free vulnerability exists in GnuTLS due to improper ownership management during the export of SAN entries containing an otherName. If the type-id OID is invalid or malformed, the function asn1_delete_structure() is called on an ASN.1 node that GnuTLS does not own, causing a double-free condition when the parent function or caller later frees the same structure. This vulnerability is exploitable via public GnuTLS APIs and may result in denial of service or memory corruption depending on allocator behavior. Red Hat has issued patches for this vulnerability in Red Hat Enterprise Linux 9 and 10 as part of a broader gnutls security update.

The vulnerability can lead to denial of service or memory corruption on affected systems running vulnerable versions of GnuTLS. There is no indication of confidentiality or integrity impact. Exploitation requires network access with high attack complexity and no privileges or user interaction. No known exploits in the wild have been reported. The CVSS v3.1 base score is 6.5 (medium severity) reflecting these factors.

Red Hat has released official security updates for GnuTLS in Red Hat Enterprise Linux 9 and 10 that address CVE-2025-32988. Applying these updates will remediate the vulnerability. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to update their systems promptly. No additional mitigation steps are required beyond applying the vendor-provided patches.