# CVE-2025-66442: In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only…

Source: https://junglewise.ai/threats/cve-2025-66442-in-mbed-tls-through-4-0-0-there-is-a-compiler-induced-timing-side  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-01  
License: CC BY 4.0 with a link back

CVE-2025-66442 · Severity: medium · CVSS 5.1 · Published 2026-04-01

In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

Technologies: [Arm Mbed Tls](https://junglewise.ai/threats/technologies/mbed-tls). Vendors: [Arm](https://junglewise.ai/threats/vendors/arm).

## Quick answers

**Is CVE-2025-66442 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66442 being exploited in the wild.

**How severe is CVE-2025-66442?** Medium severity, with a CVSS score of 5.1, published 1 April 2026.

**Which products and versions are affected?** Arm Mbed Tls, Arm Tf-Psa-Crypto. The advisory does not name versions.

**Is there a fix for CVE-2025-66442?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66442?** Check whether you run Arm Mbed Tls or Arm Tf-Psa-Crypto. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Arm Mbed Tls
- Arm Tf-Psa-Crypto

## Related threats

- [Mbed TLS memory corruption via insecure deserialization of SSL context](https://junglewise.ai/threats/cve-2026-34877-mbed-tls-memory-corruption-via-insecure-deserialization-of-ssl)
- [Mbed TLS client impersonation in TLS 1.3 session resumption](https://junglewise.ai/threats/cve-2026-34873-mbed-tls-client-impersonation-in-tls-1-3-session-resumption)
- [Arm Mbed TLS Predictable Seed in PRNG on Linux](https://junglewise.ai/threats/cve-2026-34871-arm-mbed-tls-predictable-seed-in-prng-on-linux)
- [Arm Mbed TLS and TF-PSA-Crypto PRNG state cloning vulnerability](https://junglewise.ai/threats/cve-2026-25835-arm-mbed-tls-and-tf-psa-crypto-prng-state-cloning-vulnerability)
- [Mbed TLS out-of-bounds read in mbedtls_lms_import_public_key](https://junglewise.ai/threats/cve-2025-49601-mbed-tls-out-of-bounds-read-in-mbedtls-lms-import-public-key)