CVE-2020-36424 An issue was discovered in Arm Mbed TLS before 2.24.0. An attacker can recover a private key (for RSA or static Diffie-Hellman) via a side-channel attack against generation of base blinding/unblinding values.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerabilities in Arm Mbed Crypto and Mbed TLS Expose Private Keys Two vulnerabilities have been identified in Arm Mbed Crypto and Mbed TLS that could allow local attackers to recover private keys through side-channel attacks. CVE-2019-18222, published on January 23, 2020, involves an issue with the ECDSA signature implementation, while CVE-2019-16910, published on September 26, 2019, relates to insufficient entropy in RNG when deterministic ECDSA is enabled. 3 sources 43

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)