CVE-2025-54764: Arm Mbed TLS

Medium severity, CVSS 6.2. EPSS: 0.2% chance of exploitation in the next 30 days.

Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.

Affected products

• Arm Mbed TLS: before 3.6.5 (fixed in 3.6.5)

Published 2025-10-20. Last modified 2026-06-17.