CVE-2026-25835 is a high-severity vulnerability (CVSS 7.7) impacting Mbed TLS before version 3.6.6 and TF-PSA-Crypto before 1.1.0, stemming from the misuse of seeds in their Pseudo-Random Number Generators (PRNGs). This flaw, categorized as CWE-335 (Insufficient Entropy), allows an attacker with local access and low attack complexity to achieve high impacts on confidentiality and integrity by potentially predicting random numbers, thereby compromising cryptographic operations. While the attack vector is local, no user interaction or special privileges are required once local access is established. There is currently no evidence of active exploitation, nor is public exploit code available in common databases. Community discussion is minimal, and its Exploit Prediction Scoring System (EPSS) score is very low, suggesting a low probability of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.18.0, < 3.6.6CPE matchmatch criteria | cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:* | ||
4.0.0CPE matchmatch criteria | cpe:2.3:a:trustedfirmware:mbed_tls:4.0.0:*:*:*:*:*:*:* | ||
< 1.1.0CPE matchmatch criteria | cpe:2.3:a:trustedfirmware:tf-psa-crypto:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.5 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.