A NULL pointer dereference occurs while parsing a distinguished name in Mbed TLS up to version 3.6.5 and 4.x through 4.0.0. The flaw allows an attacker to inject a write to memory address zero, potentially corrupting program state. An attacker could then cause corruption of data structures, unintentionally influence program flow, or cause crashes, leading to loss of integrity or availability of any process using the library.

ARM Mbed TLS library versions 3.6.5 and all 4.x releases up to 4.0.0 are affected. Any application linking to these releases and performing certificate parsing is at risk. The flaw is not present in versions newer than 4.0.0.

The CVSS score of 7.5 indicates high severity while the EPSS score of less than 1% suggests a low current exploitation likelihood. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker supplying a malformed Distinguished Name or certificate to a vulnerable application, triggering the null pointer dereference and producing a memory write.