CVE-2025-66442

Published: Apr 1, 2026Modified: Jun 17, 2026

5.1

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.4 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

Affected (2)

Products: Arm: Mbed Tls, Tf Psa Crypto

Arm

2 products

Mbed Tls

Tf Psa Crypto

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Arm Mbed Tls	Up to 4.0.0
Arm Tf Psa Crypto	Up to 1.0.0

Related CWEs

CWE-385

Covert Timing Channel

Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

References (4)

https://github.com/Mbed-TLS/TF-PSA-Crypto/releases

Source: cve@mitre.org

Release Notes

https://github.com/Mbed-TLS/mbedtls/releases

Source: cve@mitre.org

Release Notes

https://mbed-tls.readthedocs.io/en/latest/security-advisories/

Source: cve@mitre.org

Vendor Advisory

https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/

Source: cve@mitre.org

Vendor Advisory

Timeline

No history available yet.