This vulnerability in Mbed TLS affects versions 2.19.0 through 3.6.5 and 4.0.0. It arises due to insufficient protection of serialized SSL context or session structures. An attacker capable of modifying these serialized structures can induce memory corruption, leading to arbitrary code execution. The root cause is the incorrect use of privileged APIs. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability with no required privileges or user interaction.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems without requiring privileges or user interaction. This compromises confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official Mbed TLS channels for updates. Until a fix is available, avoid using vulnerable versions or restrict access to serialized SSL context/session structures to trusted parties only.