The flaw is caused by improper seeding of the pseudo‑random number generator in Mbed TLS versions earlier than 3.6.6 and in TF‑PSA‑Crypto versions earlier than 1.1.0. Because the seed values are not sufficiently random, the output of the PRNG can become predictable. If an attacker can influence the seed or observe the PRNG output, they could recover cryptographic keys or forge tokens, thereby breaching confidentiality and integrity of encrypted or signed data.

Systems that link against ARM’s Mbed TLS library prior to version 3.6.6 and those that use TF‑PSA‑Crypto prior to version 1.1.0 are affected. Applications that rely on the default PRNG for key generation, TLS handshakes, or random token creation may be impacted.

The CVSS base score is 7.7, indicating a high severity, while the EPSS score is below 1 %, suggesting that exploitation is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker influencing the source of entropy used to seed the PRNG, for example by providing crafted input to cryptographic operations or manipulating environment values. This inference is based on the description of the seed misuse; no public exploit has been reported to date.