Summaryinfo

A vulnerability was found in mbed TLS up to 3.6.5. It has been rated as problematic. This vulnerability affects unknown code. Performing a manipulation results in entropy. This vulnerability was named CVE-2026-25835. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in mbed TLS up to 3.6.5. This affects an unknown function. The manipulation with an unknown input leads to a entropy vulnerability. CWE is classifying the issue as CWE-332. The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat. This is going to have an impact on confidentiality. The summary by CVE is:

Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).

The advisory is shared at mbed-tls.readthedocs.io. This vulnerability is uniquely identified as CVE-2026-25835 since 02/06/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

Upgrading to version 3.6.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-17999). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• mbed TLS

Version

• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3
• 3.6.4
• 3.6.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion