CVE-2026-34871
Analyzed Analyzed - Analysis Complete
Predictable Seed Vulnerability in Mbed TLS and TF-PSA PRNG

Publication date: 2026-04-01

Last updated on: 2026-06-05

Assigner: MITRE

Description
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-01
Last Modified
2026-06-05
Generated
2026-06-16
AI Q&A
2026-04-01
EPSS Evaluated
2026-06-15
NVD
CVE-2026-34871
EUVD
EUVD-2026-18001
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
trustedfirmware tf-psa-crypto From 1.1.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-34871 is a vulnerability in Mbed TLS and TF-PSA-Crypto where the pseudo-random number generator (PRNG) uses a predictable seed. Specifically, on Linux systems, the entropy source can fall back to using /dev/urandom, which may weaken the randomness quality used by the cryptographic library.

Impact Analysis

This vulnerability can impact the security of cryptographic operations that rely on high-quality randomness. If the PRNG seed is predictable, attackers may be able to predict cryptographic keys or other sensitive values generated by the library, potentially compromising confidentiality and integrity.

Compliance Impact

The provided information does not specify how the vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34871. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart