Vulnerabilities Discovered in Mbed TLS Affecting Certificate Validation and Memory Security

First seen 18 Feb 2026, 11:17 UTC • Api.Msrc.Microsoft

•46

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Two vulnerabilities were identified in Mbed TLS, affecting versions prior to 2.25.0 and 2.24.0. CVE-2020-36478 allows a NULL algorithm parameters entry to be misinterpreted as valid, while CVE-2020-36476 involves missing zeroization of plaintext buffers, risking exposure of sensitive data. Both issues were published on August 23, 2021.

How this analysis works

Timeline

2021-08-23

CVE-2020-36478 published

2021-08-23

CVE-2020-36476 published

2026-02-18

Information published about CVE-2020-36478

2026-02-18

Information published about CVE-2020-36476

Attack Flow

14 entities, 13 inferred relationships (STIX 2.1).

Technique (4)

Data Breach
Denial of Service
Man-in-the-Middle
Zero-day Exploit

Vulnerability (9)

CVE-2020-36475
CVE-2020-36476
CVE-2020-36477
CVE-2020-36478
CVE-2021-43666
CVE-2021-44732
CVE-2022-35409
CVE-2025-27809
CVE-2025-27810

Affected Platform (1)

Mbed TLS

Relationships

CVE-2020-36475 targets Mbed TLS
CVE-2020-36476 targets Mbed TLS
CVE-2020-36477 targets Mbed TLS
CVE-2020-36478 targets Mbed TLS
CVE-2021-43666 targets Mbed TLS
CVE-2021-44732 targets Mbed TLS
CVE-2022-35409 targets Mbed TLS
CVE-2025-27809 targets Mbed TLS
CVE-2025-27810 targets Mbed TLS
Data Breach targets Mbed TLS
Denial of Service targets Mbed TLS
Man-in-the-Middle targets Mbed TLS
Zero-day Exploit targets Mbed TLS

Continue Reading

Critical Mbed TLS Vulnerabilities Affect Multiple Ubuntu Releases Vulnerabilities in Arm Mbed Crypto and Mbed TLS Expose Private Keys Multiple Vulnerabilities Found in Mbed TLS Affecting Key Security

Vulnerabilities Discovered in Mbed TLS Affecting Certificate Validation and Memory Security

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading