AIKIDO-2026-610459

TL;DR

When parsing PEM-encrypted material through mbedtls_pk_parse_key(), mbedtls_pk_parse_keyfile(), or mbedtls_pem_read_buffer(), the decryption code can read one byte before the start of a heap buffer it allocated. Processing untrusted PEM-encrypted input with a password argument triggers the out-of-bounds read. This typically results in a crash or limited disclosure of adjacent memory. The fix corrects the bounds handling so the read stays within the allocated buffer.