CVE-2026-25835 Weak cryptography in n/a
Misuse of PRNG seeds in Mbed TLS and TF-PSA-Crypto weakens cryptographic security, potentially allowing attackers to predict random values.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25835?
CVE-2026-25835 is a high-severity vulnerability in Arm Mbed Tls, published on 1 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
Weakness: CWE-335
Which versions are affected by CVE-2026-25835?
It affects 3 products.
Products include Arm Mbed Tls, Trustedfirmware Mbed Tls, Trustedfirmware Tf-Psa-Crypto.
How do I fix CVE-2026-25835?
Upgrade to a fixed version.
Is CVE-2026-25835 being exploited?
There is no known exploitation of CVE-2026-25835 in the wild and no public exploit code.
Other vulnerabilities in Arm Mbed Tls
Sources
Also known as ALPINE-CVE-2026-25835, DEBIAN-CVE-2026-25835, ECHO-684c-26fc-673d, GHSA-76mm-6xm9-hwpx, JLSEC-2026-464, ROOT-OS-DEBIAN-12-CVE-2026-25835 and 1 more.