CVE-2021-44732 Use after free in n/a
A double free vulnerability in Mbed TLS allows attackers to cause denial of service or potentially execute code via out-of-memory conditions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-44732?
CVE-2021-44732 is a critical use after free vulnerability in Arm Mbed Tls, published on 20 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.
Weakness: CWE-415
Which versions are affected by CVE-2021-44732?
It affects 3 products.
Products include Arm Mbed Tls, Debian Debian Linux, Trustedfirmware Mbed Tls.
How do I fix CVE-2021-44732?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2021-44732 being exploited?
There is no known exploitation of CVE-2021-44732 in the wild and no public exploit code.
Other vulnerabilities in Arm Mbed Tls
- CVE-2026-34877 Deserialization in n/a
- CVE-2022-46393 Memory corruption in n/a
- CVE-2017-18187 Integer overflow in n/a
- CVE-2018-0487 Memory corruption in ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0
- CVE-2018-0488 Memory corruption in ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0
Sources
Also known as ALPINE-CVE-2021-44732, DEBIAN-CVE-2021-44732, GHSA-7g56-f7p4-fmcq, JLSEC-2025-214, MGASA-2022-0017, UBUNTU-CVE-2021-44732.