CVE-2025-52496: 
Mbed TLS vulnerability analysis and mitigation

Mbed TLS before version 3.6.4 contains a race condition vulnerability in AESNI detection when certain compiler optimizations occur (NVD). The vulnerability was disclosed on July 4, 2025, and affects the cryptographic functionality of the Mbed TLS library.

The vulnerability exists as a race condition in the AESNI (Advanced Encryption Standard New Instructions) detection mechanism when specific compiler optimizations are applied. The issue has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating local access required with high attack complexity but no privileges or user interaction needed (NVD, Ubuntu).

The vulnerability can allow an attacker to extract an AES key from a multithreaded program or perform a GCM (Galois/Counter Mode) forgery. This poses a significant risk to the confidentiality and integrity of encrypted communications in affected systems (NVD).

The primary mitigation is to upgrade Mbed TLS to version 3.6.4 or later, which contains the fix for this vulnerability. Organizations using affected versions should prioritize this update to prevent potential exploitation (NVD).