The vulnerability stems from insufficient protection of serialized SSL context or session structures. An attacker who can modify these serialized strings can trigger memory corruption that leads to arbitrary code execution. The weakness originates from incorrect use of privileged APIs, allowing exploitation of the encryption library’s serialization routines.

Mbed TLS, versions 2.19.0 through 3.6.5 and the 4.0.0 release, are impacted. The issue appears in the core TLS library and may affect any application that uses that version of the library.

The CVSS score of 9.8 places this vulnerability in the critical range. While the EPSS score is unavailable and the vulnerability is not listed in the KEV catalog, the high severity indicates significant risk. Based on the description, the likely attack vector involves an attacker who can inject or alter serialized SSL context data, possibly via the network or a compromised storage medium, leading to execution of privileged code paths within the library and full compromise of the vulnerable process.