An application using the random number generator library Botan from versions 3.7.0 through 3.13.0 may unknowingly reinitialize its RNG to a predictable state. The issue occurs when a caller invokes AutoSeeded_RNG::clear() and then requests random data with an empty output buffer while the generator remains unseeded. The library then marks the RNG as seeded without querying the configured entropy source, leaving it potentially seeded only with clock values and process IDs on builds without system‑backed randomness. This predictable state can lead to repeated or biased outputs, undermining the security of keys, nonces, or other cryptographic material generated thereafter. The vulnerability does not grant remote code execution but can still facilitate key compromise or entropy exhaustion attacks.

Affected by this vulnerability are all applications that link to randombit botan 3.7.0 up to and including 3.13.0. The flaw resides in the AutoSeeded_RNG class and impacts builds that do not enable BOTAN_HAS_SYSTEM_RNG, meaning the fallback entropy source may use only clock values and process IDs. The issue also affects any runtime that calls AutoSeeded_RNG::clear() before generating random data with an empty buffer. Upgrading to 3.13.0 or later resolves the problem by correctly seeding from a trusted source.

Risk assessment shows a CVSS score of 7.3, indicating moderate to high severity. The EPSS score is not available, so the current exploitation likelihood remains unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an attacker to influence the sequence of RNG calls, for example by modifying application behavior or supplying specific inputs, to trigger the predictable reseeding scenario. If achieved, future RNG output can become predictable, endangering keys or nonces.