BaseFortify

Publication date: 2025-10-20

Last updated on: 2025-10-31

Assigner: MITRE

Description

Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-20

Last Modified

2025-10-31

Generated

2026-07-06

AI Q&A

2025-10-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-54764

EUVD

EUVD-2025-35113

Affected Vendors & Products

Vendor	Product	Version / Range
arm	mbed_tls	to 3.6.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This vulnerability in Mbed TLS versions before 3.6.5 allows a local attacker to perform a timing attack on certain RSA operations and on direct calls to specific mathematical functions (mbedtls_mpi_mod_inv or mbedtls_mpi_gcd). This means an attacker could potentially gain sensitive information by measuring the time taken to perform these cryptographic operations.

Impact Analysis

The vulnerability could allow a local attacker to extract sensitive cryptographic information by analyzing timing differences during RSA operations, potentially compromising the security of encrypted data or cryptographic keys.

Hi! I’m here to help you understand CVE-2025-54764. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70