CVE-2025-52496 Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Found in Mbed TLS Affecting Key Security Two vulnerabilities have been identified in Mbed TLS that could allow attackers to extract sensitive cryptographic keys. CVE-2020-10941, published on March 24, 2020, enables attackers to obtain RSA private keys through cache measurement. CVE-2025-52496, published on July 4, 2025, presents a race condition that may allow AES key extraction or GCM forgery in multithreaded applications. 7 sources 39

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

Platforms (1)