EUVD-2025-20079

Malicious code in bioql PyPI...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the mbedtlslmsimportpublickey function. An attacker can cause a crash or disclose limited adjacent memory by providing a truncated LMS public-key buffer that is less than four bytes in length. Workaround For the...

CVE-2025-49601

CVE-2025-49601 affects MbedTLS 3.3.0 through 3.6.3 (fixed in 3.6.4). The issue is in mbedtls_lms_import_public_key, which reads a 4-byte type indicator before validating the input size. If the input LMS public-key buffer is truncated to fewer than four bytes, this allows an out-of-bounds read, po...

CVE-2025-49601

In MbedTLS 3.3.0 before 3.6.4, mbedtlslmsimportpublickey does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtlslmsimportpublickey allows context-dependent...