AIKIDO-2026-214049

TL;DR

The function mbedtls_x509_string_to_names() documents its head argument as an output parameter but internally calls a deep free on it. Applications that follow the documentation keep pointers to memory that the function frees, leading to use-after-free or double-free when they later use or release those pointers. Depending on the allocator this can escalate to arbitrary code execution, and the bundled cert_write and cert_req sample programs are affected. The fix rejects a non-NULL pointer target so the unexpected free no longer occurs.