CVE-2026-34871 Weak cryptography in n/a
Attackers can predict random numbers due to a flawed PRNG seed in Mbed TLS, compromising cryptographic security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34871?
CVE-2026-34871 is a medium-severity vulnerability in Arm Mbed Tls, published on 1 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
Weakness: CWE-338
Which versions are affected by CVE-2026-34871?
It affects 2 products.
Products include Arm Mbed Tls, Trustedfirmware Tf-Psa-Crypto.
How do I fix CVE-2026-34871?
Upgrade to a fixed version.
Is CVE-2026-34871 being exploited?
There is no known exploitation of CVE-2026-34871 in the wild and no public exploit code.
Other vulnerabilities in Arm Mbed Tls
Sources
Also known as DEBIAN-CVE-2026-34871, ECHO-93fb-0419-2b65, GHSA-rjq9-c3rf-c638, JLSEC-2026-465, UBUNTU-CVE-2026-34871.