CVE-2025-49600

A flaw was found in mbedtls. The mbedtlslmsverify function may accept forged Leighton-Micali signatures when hash computation fails and internal error conditions are not properly checked. This flaw allows an attacker with physical access to create invalid signatures. This issue occurs because...

CVE-2025-49600

In MbedTLS 3.3.0 before 3.6.4, mbedtlslmsverify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS Leighton-Micali Signature forgery in a fault scenario. Specifically, unchecked return values in mbedtlslmsverify allow an attacker who can induce ...

openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec()

An out of bounds write flaw was discovered in the OpenSSL BNbn2dec function. An attacker able to make an application using OpenSSL to process a large BIGNUM could cause the application to crash or, possibly, execute arbitrary code...