The vulnerability arises from inadequate validation of finite‑field Diffie‑Hellman peer key inputs in Mbed TLS versions 3.5.x through 3.6.5 and TF‑PSA‑Crypto 1.0.0, allowing a malicious peer to force the negotiated shared secret into a limited, predictable set of values. This lack of contributory behavior permits an attacker to influence the symmetric key used for subsequent encryption, potentially compromising confidentiality of the protected communication. The issue is rooted in improper input validation (CWE-1287) and mishandling of cryptographic protocols (CWE-347).

Products affected are the ARM Mbed TLS library in the 3.5.x to 3.6.5 series and the TF‑PSA‑Crypto 1.0.0 implementation. These libraries are embedded in many IoT devices, secure elements, and other systems that perform finite‑field Diffie‑Hellman key exchanges. The flaw applies wherever these libraries are used to exchange keys in protocols that rely on contributory behavior; TLS itself is not impacted because it does not depend on contribution for key establishment.

The CVSS score of 9.1 indicates a severe risk if exploited, while an EPSS score below 1 % suggests exploitation is unlikely but possible. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation does not require local privileges; an attacker can act as a peer or perform a man‑in‑the‑middle attack to supply malicious parameters. Successful exploitation would alter the derived key, allowing compromised confidentiality of any data encrypted with that key.