# CVE-2026-25835: Arm Mbed TLS and TF-PSA-Crypto PRNG state cloning vulnerability

Source: https://junglewise.ai/threats/cve-2026-25835-arm-mbed-tls-and-tf-psa-crypto-prng-state-cloning-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-25835 · Severity: high · CVSS 7.7 · Published 2026-04-01

Mbed TLS and TF-PSA-Crypto are widely used cryptographic libraries that provide secure communication and data protection for embedded devices and applications. A vulnerability in these libraries could allow different instances of an application (such as those created by cloning a virtual machine or using the fork command) to generate identical random numbers, including security keys and nonces. This could allow an attacker to predict sensitive cryptographic values, potentially leading to the decryption of private data or the impersonation of legitimate users.

Technologies: [Arm Mbed Tls](https://junglewise.ai/threats/technologies/mbed-tls). Vendors: [Arm](https://junglewise.ai/threats/vendors/arm).

## Quick answers

**Is CVE-2026-25835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25835 being exploited in the wild.

**How severe is CVE-2026-25835?** High severity, with a CVSS score of 7.7, published 1 April 2026.

**Which products and versions are affected?** Arm Mbed Crypto All versions; Arm Mbed Tls 2.18.0 to 3.6.5, 4.0.0.

**Is there a fix for CVE-2026-25835?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-25835 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-25835?** Check whether you run Arm Mbed Crypto or Arm Mbed Tls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability (CWE-335) exists in the PSA subsystem of Mbed TLS and TF-PSA-Crypto because the internal random generator does not automatically reseed or provide an interface to force a reseed after a 'cloning' event. Cloning occurs during Unix fork() calls, virtual machine snapshots, or hibernation resumes, resulting in multiple instances sharing the same PRNG state. Consequently, these instances generate identical random sequences (keys, nonces, etc.), which can be exploited by an attacker to recover session keys or predict future outputs. The fix introduces automatic reseeding on Unix-like systems via fork protection and provides new APIs (psa_random_reseed) for manual control in other cloning scenarios. Affected versions include Mbed TLS 2.18.0 through 3.6.5 and 4.0.0, and TF-PSA-Crypto 1.0.0.

## Affected products

- Arm Mbed TLS 2.18.0 to 3.6.5, 4.0.0
- Arm TF-PSA-Crypto 1.0.0
- Arm Mbed Crypto All versions

## Timeline

- 2026-03-31: advisory: Vendor advisory published by Mbed TLS team
- 2026-04-01: disclosed: CVE-2026-25835 published
- 2026-06-01: other: NVD last modified date

## References

- [https://mbed-tls.readthedocs.io/en/latest/security-advisories/](https://mbed-tls.readthedocs.io/en/latest/security-advisories/)
- [https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-rng-cloning/](https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-rng-cloning/)

## Related threats

- [Mbed TLS memory corruption via insecure deserialization of SSL context](https://junglewise.ai/threats/cve-2026-34877-mbed-tls-memory-corruption-via-insecure-deserialization-of-ssl)
- [Mbed TLS client impersonation in TLS 1.3 session resumption](https://junglewise.ai/threats/cve-2026-34873-mbed-tls-client-impersonation-in-tls-1-3-session-resumption)
- [In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only…](https://junglewise.ai/threats/cve-2025-66442-in-mbed-tls-through-4-0-0-there-is-a-compiler-induced-timing-side)
- [Arm Mbed TLS Predictable Seed in PRNG on Linux](https://junglewise.ai/threats/cve-2026-34871-arm-mbed-tls-predictable-seed-in-prng-on-linux)
- [Mbed TLS out-of-bounds read in mbedtls_lms_import_public_key](https://junglewise.ai/threats/cve-2025-49601-mbed-tls-out-of-bounds-read-in-mbedtls-lms-import-public-key)