CVE-2021-36647 Weak cryptography in n/a

Medium 4.7 Published 17 Jan 2023 Updated 3 Nov 2025

Attackers with precise timing and memory access can recover RSA private keys from Mbed TLS due to a risky cryptographic algorithm implementation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-36647?

CVE-2021-36647 is a medium-severity vulnerability in Arm Mbed Tls, published on 17 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA.

Weakness: CWE-327

Which versions are affected by CVE-2021-36647?

It affects 2 products.

Products include Arm Mbed Tls, Trustedfirmware Mbed Tls.

How do I fix CVE-2021-36647?

Upgrade to a fixed version.

Is CVE-2021-36647 being exploited?

There is no known exploitation of CVE-2021-36647 in the wild and no public exploit code.

All Arm Mbed Tls vulnerabilities

Sources

Also known as AZL-13023, AZL-47713, DEBIAN-CVE-2021-36647, GHSA-7wwm-8prx-hpg2, JLSEC-2025-221, UBUNTU-CVE-2021-36647.