Mbed TLS EUVD-2026-85930

Requires the attacker to be able to cause the entropy/random-generator source to fail on an affected Mbed TLS server - a specific fault condition (e.g., fault injection, RNG degradation, or resource exhaustion), not ordinary network access. Only TLS 1.3 servers running Mbed TLS 3.2.0 through 3.6.6 or 4.0.0 through 4.1.0 are affected; TLS 1.2 servers and client roles are not. Limiting factors: the entropy-failure prerequisite (reflected as AV:L/AC:H), the narrow TLS-1.3-server-only scope, and impact restricted to injecting/removing bytes at the start of the stream (integrity only, no confidentiality or availability loss).

This is a genuinely low-priority issue despite being a flaw in a widely-used TLS library. The CVSS 3.1 base score is 2.9 (Low), and every signal reinforces that: the vector is AV:L (local) with AC:H (high complexity) because exploitation hinges on the attacker first being able to force the entropy/RNG source to fail - a fault-injection or environmental-manipulation precondition, not a routine network action. Impact is limited to I:L (injecting/removing a few bytes at the very start of the TLS stream) with C:N and A:N, so there is no confidentiality loss or code execution despite the misleading 'Code Injection' tag. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data. SSVC-style framing: exploitation = none observed, automatable = no (requires a bespoke entropy-fault capability against a specific TLS 1.3 server), technical impact = partial/low. The 'trustedfirmware' vendor and 'Mbed Tls' product tags are correct, but the 'Code Injection' tag mischaracterizes the flaw (CWE-394, a random-generator fault affecting TLS integrity, not remote code injection). No conflicting signals: the low CVSS, absent exploitation evidence, and demanding preconditions all agree this is a defense-in-depth fix rather than an urgent patch.

An attacker with the ability to induce entropy-source failure on an Mbed TLS 3.2.0-3.6.6 / 4.0.0-4.1.0 TLS 1.3 server (e.g., via fault injection, resource starvation, or a degraded hardware RNG) causes the random generator to return faulty output, letting them remove or inject bytes at the beginning of the outgoing TLS stream and undermine record-layer integrity. No public exploit code is identified at time of analysis, and the entropy-fault requirement plus AV:L/AC:H make this a targeted, laboratory-grade attack rather than a mass-exploitable one.