Mbed TLS 3.6.4 - Use-After-Free

Impact

For European organizations, the impact of this use-after-free vulnerability depends largely on the deployment context of Mbed TLS 3.6.4. Since Mbed TLS is prevalent in embedded systems, IoT devices, and network appliances, affected devices could experience crashes leading to denial of service or, in worst cases, arbitrary code execution allowing attackers to escalate privileges or exfiltrate sensitive data. Critical infrastructure sectors such as energy, manufacturing, and telecommunications that rely on embedded cryptographic libraries may face operational disruptions or security breaches. The local exploitation requirement reduces the likelihood of widespread remote attacks but elevates insider threat risks or attacks via compromised local networks. Confidentiality and integrity of communications secured by the vulnerable library could be compromised if exploitation is successful. The medium severity rating reflects a moderate risk level, but the potential for cascading effects in interconnected systems means organizations should not underestimate the threat.