CVE-2025-66442 in mbed TLS
Summary
In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.
Responsible
MITRE
Reservation
12/01/2025
Disclosure
04/01/2026
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354759 | mbed TLS RSA/CBC/ECB covert timing channel | 385 | Not defined | Not defined | CVE-2025-66442 |