Skip to main content

Compiler Optimization Removal or Modification of Security-critical Code

CVE-2025-52496

High
7.8/10

Summary

Mbed TLS has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery. This issue affects versions mbedtls-1.3.10 through mbedtls-3.6.3.

  • HIGH
  • LOCAL
  • HIGH
  • CHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-733 - Compiler Optimization Removal or Modification of Security-critical Code

The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.

References

Advisory Timeline

  • Published