Arm Mbed TLS — Cyber Threats, Attacks & Incidents

Related Threat Clusters

• Vulnerabilities in Arm Mbed Crypto and Mbed TLS Expose Private Keys

  Two vulnerabilities have been identified in Arm Mbed Crypto and Mbed TLS that could allow local attackers to recover private keys through side-channel attacks. CVE-2019-18222, published on January 23, 2020, involves an…

  3 articles · Updated February 18, 2026
• Multiple Vulnerabilities Found in Mbed TLS Affecting Key Security

  Two vulnerabilities have been identified in Mbed TLS that could allow attackers to extract sensitive cryptographic keys. CVE-2020-10941, published on March 24, 2020, enables attackers to obtain RSA private keys through…

  7 articles · Updated February 18, 2026

Recent Intelligence Reports

• CVE-2020-36422 An issue was discovered in Arm Mbed TLS before 2.23.0. A side channel allows recovery of an ECC private key, related to mbedtls_ecp_check_pub_priv, mbedtls_pk_parse_key, mbedtls_pk_parse_keyfile, mbedtls_ecp_mul, and mbedtls_ecp_mul_restartable. — Api.Msrc.Microsoft · February 18, 2026
• CVE-2020-36425 An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock. — Api.Msrc.Microsoft · February 18, 2026
• CVE-2019-16910 Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.) — Api.Msrc.Microsoft · February 18, 2026

Related Entities