A compiler-induced timing side channel exists in Mbed TLS through version 4.0.0 and in TF-PSA-Crypto through version 1.0.0. The flaw manifests during RSA and CBC/ECB decryption when LLVM’s select‑optimize feature is enabled, allowing an adversary to infer secrets from subtle timing variations in the decryption process. This can lead to leakage of private keys or plaintext data.

ARM’s Mbed TLS library up to and including release 4.0.0, and the TF-PSA-Crypto library up to and including release 1.0.0 are affected. Any applications or systems that use these libraries with LLVM’s select‑optimize enabled are potentially vulnerable.

The CVSS score of 5.1 indicates medium severity, but the EPSS score of less than 1 % and absence from the KEV catalog imply a low likelihood of active exploitation. Exploitation requires that the vulnerable library be compiled with LLVM’s select‑optimize enabled, so the attack surface is limited to developers or build environments that use these settings. If an attacker can influence the compilation of code containing the vulnerable libraries on a target system, they could measure timing differences and gain sensitive information, but widespread, automated exploitation is currently unlikely.