CVE-2026-118765 in Botan
Summary
by MITRE • 10/29/2026
Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeeded_RNG to mark itself seeded without consulting the configured entropy source. On builds without BOTAN_HAS_SYSTEM_RNG, the fallback uses only a clock value and process ID, so a later non-empty request can produce output from predictable state. This issue is fixed in version 3.13.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The Botan cryptography library contains a critical implementation flaw within its AutoSeeded Random Number Generator that compromises the integrity of entropy initialization sequences. The vulnerability exists in versions ranging from 3.7.0 through 3.13.0 and stems from an incorrect state management logic when handling empty output requests during specific operational states. Specifically, if an application invokes the clear method to reset the generator's internal state followed immediately by a randomize call with an empty buffer while the generator is in an unseeded condition, the library erroneously transitions the RNG into a seeded state without actually consulting or gathering entropy from the configured sources. This behavior violates fundamental cryptographic principles regarding randomness generation and leaves the system vulnerable to predictable output if subsequent operations rely on this compromised seed status.
The technical root cause lies in how the AutoSeeded_RNG class handles edge cases during initialization cycles. When the generator is unseeded, it should strictly require entropy acquisition before marking itself as ready for use. However, the presence of an empty buffer request triggers a code path that bypasses this check under certain conditions. On builds where system-level random number generation features are disabled via the BOTAN_HAS_SYSTEM_RNG configuration flag, the fallback mechanism relies solely on low-entropy sources such as clock values and process identifiers. Consequently, once the generator incorrectly marks itself as seeded due to the empty buffer interaction, any subsequent non-empty request for randomness will produce output derived from this predictable state rather than cryptographically secure entropy. This results in a severe degradation of security posture where generated keys, tokens, or session IDs may be guessable by an attacker with knowledge of system timing and process metadata.
The operational impact of this vulnerability is significant for any application relying on Botan for cryptographic key generation, nonce creation, or token management. If the RNG outputs are predictable, attackers can potentially reconstruct secret values used in encryption schemes, authentication protocols, or session management systems. This undermines confidentiality and integrity guarantees provided by higher-level cryptographic operations that depend on unique, unpredictable inputs. The risk is particularly acute in environments where process IDs and system clocks are easily observable or guessable, which includes many containerized or virtualized deployments common in modern cloud infrastructure.
This flaw aligns with CWE-330, Use of Insufficiently Random Values, as the generated outputs fail to meet the statistical randomness requirements necessary for cryptographic security due to reliance on predictable state variables. Furthermore, it relates to CWE-284 Improper Access Control regarding internal state management, where the application fails to enforce proper initialization sequences before allowing data generation. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques associated with T1059 Command and Scripting Interpreter or broader exploitation frameworks that leverage weak randomness for privilege escalation or session hijacking, although it is primarily a foundational weakness enabling such attacks rather than an attack technique itself.
To mitigate this risk, organizations using the Botan library must upgrade to version 3.13.0 or later where the logic governing entropy source consultation has been corrected to prevent premature seeding on empty buffer requests. For applications unable to update immediately, developers should implement application-level safeguards by ensuring that RNG instances are properly seeded before any randomize calls occur and avoiding patterns that involve clearing state followed by immediate empty-buffer interactions during unseeded periods. Additionally, reviewing code for proper initialization sequences and validating entropy source availability can help reduce exposure until the library patch is applied.