# CVE-2026-118765: Botan AutoSeeded_RNG weak seeding on empty output buffer

Source: https://junglewise.ai/threats/cve-2026-118765-botan-is-a-c-cryptography-library-from-3-7-0-until-3-13-0-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-118765 · Severity: info · Published 2026-10-29

Botan is a C++ cryptography library used in applications that require cryptographic operations. A flaw in the random number generator initialization causes it to mark itself as seeded without consulting the entropy source when an empty buffer is passed, leading to predictable random numbers on systems without system RNG support. This could compromise the security of cryptographic operations that rely on this generator.

Technologies: [Botan](https://junglewise.ai/threats/technologies/botan-botan). Vendors: [Botan](https://junglewise.ai/threats/vendors/botan).

## Quick answers

**Is CVE-2026-118765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118765 being exploited in the wild.

**How severe is CVE-2026-118765?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** Botan 3.7.0 to 3.13.0.

**Is there a fix for CVE-2026-118765?** Yes: fixed in 3.13.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118765 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-118765?** Check whether you run Botan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.13.0

## Technical details

In Botan versions 3.7.0 through 3.13.0, the AutoSeeded_RNG::fill_bytes_with_input() method does not properly validate empty output buffers before seeding, causing the generator to transition to a seeded state without consulting configured entropy sources. On builds lacking BOTAN_HAS_SYSTEM_RNG, this results in reliance on only clock values and process IDs as entropy, producing predictable output. The fix checks for both empty output and input buffers before transitioning to seeded state.

## Affected products

- Botan Botan 3.7.0 to 3.13.0

## Timeline

- 2026-10-29: disclosed

## References

- [https://github.com/randombit/botan/commit/a7389222ace990604b6985add91ee06f55a80c0e](https://github.com/randombit/botan/commit/a7389222ace990604b6985add91ee06f55a80c0e)
- [https://github.com/randombit/botan/pull/5838](https://github.com/randombit/botan/pull/5838)

## Related threats

- [Botan X.509 Distinguished Name constraint bypass via multi-value RDN](https://junglewise.ai/threats/cve-2026-48057-botan-is-a-c-cryptography-library-prior-to-3-13-0-botan-s-x-509)
- [Botan OCSP signature verification bypass in ocsp_check CLI](https://junglewise.ai/threats/cve-2026-118768-botan-is-a-c-cryptography-library-from-1-11-34-until-3-13-0-the)
- [Botan Python binding password hashing bypass](https://junglewise.ai/threats/cve-2026-118767-botan-is-a-c-cryptography-library-from-1-11-22-until-3-13-0)