Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context (CVE-2026-50579)

Title	Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context
CVE	CVE-2026-50579
Date	7th of July, 2026
Affects	Mbed TLS 3.3.0 through 3.6.6; Mbed TLS 4.0.0 through 4.1.0
Not affected	Mbed TLS before 3.3.0; Mbed TLS 3.6.7 and later 3.6.x versions; Mbed TLS 4.1.1 and later 4.1.x versions; Mbed TLS 4.2.0 and later versions
Impact	Memory corruption and denial of service
Severity	HIGH
Credits	NVIDIA Project Vanessa

Vulnerability

mbedtls_pkcs7_free() frees the signer list in an mbedtls_pkcs7 context, but in affected versions it only clears pkcs7->raw.p before returning. Other fields in the context, including signed_data.signers.next, can therefore retain stale pointers to freed memory.

An application is vulnerable if it parses PKCS7 data into an mbedtls_pkcs7 context, calls mbedtls_pkcs7_free() on that context, and later reuses the same context for another PKCS7 parse without first reinitializing it. In such a parse -> free -> parse -> free sequence, specially crafted PKCS7 input can leave stale signer-list pointers in the context and cause a later free operation to walk freed memory.

Applications are not affected if they do not build or enable MBEDTLS_PKCS7_C, if they do not parse PKCS7 data, or if they do not reuse an mbedtls_pkcs7 context after calling mbedtls_pkcs7_free() without reinitializing it.

Impact

A malicious PKCS7 input can trigger a use-after-free or double-free in applications that reuse an mbedtls_pkcs7 context after freeing it. This can lead to memory corruption and denial of service. Depending on the platform, allocator behavior, and surrounding application memory layout, further impact may be possible.

Affected versions

Mbed TLS 3.3.0 through 3.6.6 are affected. Mbed TLS 4.0.0 through 4.1.0 are affected.

Mbed TLS versions before 3.3.0 are not affected because they do not include the affected PKCS7 parser code.

TF-PSA-Crypto is not affected.

Work-around

Applications using an affected version should not reuse an mbedtls_pkcs7 context after calling mbedtls_pkcs7_free() unless the context is reinitialized with mbedtls_pkcs7_init() before the next parse operation.

Applications can also avoid the issue by using a fresh mbedtls_pkcs7 context for each PKCS7 parse/free cycle.

Resolution

Affected users should upgrade to Mbed TLS 3.6.7 or a later 3.6.x version, or to Mbed TLS 4.1.1 or a later 4.1.x version, or to Mbed TLS 4.2.0 or a later version.

Fix commits

We recommend that users upgrade to a release including the fix. However, if you are maintaining a branch with backported bug fixes, here are the most relevant commits. Please note that these commits may not apply cleanly to older versions of the library, and may not provide a complete fix even if they do apply. The TF-PSA-Crypto and Mbed TLS development team does not provide support outside of maintained branches.

Branch	Mbed TLS 3.6.x	TF-PSA-Crypto 1.1.x	TF-PSA-Crypto 1.x (x>1)	Mbed TLS 4.1.x	Mbed TLS 4.x (x>1)
Basic fix	699d4030c2eba488033d2291d52966533c819db0	N/A	N/A	b1a4b07509cbadbaa963ae896d4d44ddba550f74	67e696b430716f95ed714f2c1404681697251438
With tests and documentation	699d4030c2eba488033d2291d52966533c819db0^..12717ec8f4c3c4721365c6dcb588e77f3ef6e223	N/A	N/A	b1a4b07509cbadbaa963ae896d4d44ddba550f74^..c20cd06cb41453ed29609c3cd9aacf24e54a7083	67e696b430716f95ed714f2c1404681697251438^..377aa4eff16cd0aa5e7440a41de59847e3a789a0