Arm Tf-Psa-Crypto vulnerabilities

2 CVEs affecting Arm Tf-Psa-Crypto, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-34872, published 2026-04-01.

More from Arm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-34872, published 2026-04-01. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input validation. Using finite-field…
• CVE-2025-66442, published 2026-04-01. Medium severity, CVSS 5.1. EPSS: 0.3% chance of exploitation in the next 30 days. In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also…