CVE-2026-25835

Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).

Score

CVSS 3.1 7.7 High

Status

Analyzed - cve@mitre.org

Published

2026-04-01

Last modified

2026-04-01

Weaknesses

CWE-335

Affected products

• Mbed Tls (Arm)
• Mbed Tls (Trustedfirmware)
• Tf-psa-crypto (Trustedfirmware)

References

• https://mbed-tls.readthedocs.io/en/latest/security-advisories/
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-rng-cloning/