The vulnerability is a stack-based buffer overflow in the x509_inet_pton_ipv6 function of mbed TLS. The flaw allows an attacker to overwrite adjacent memory when parsing malformed IPv6 addresses during X.509 certificate processing. This overflow could lead to memory corruption, crashes, or arbitrary code execution depending on the execution context, and is classified under CWE‑121.

Arm’s mbed TLS library, versions 3.5.0 through 3.6.5, and the 4.0.x series up until the 4.1.0 release, are affected. The patch was introduced in version 3.6.6 and 4.1.0. Systems that compile or embed these older mbed TLS versions are potentially vulnerable.

The CVSS score of 7.5 indicates a high severity. However, the EPSS score is below 1%, suggesting a low probability of exploitation in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers could trigger the overflow by supplying a malicious IPv6 address, which may be delivered via a crafted X.509 certificate or any input that goes through the vulnerable function. The lack of a known working exploit and the low EPSS reduce immediate risk, but the potential for remote code execution warrants prompt action.