PT-2026-132402
CVE-2026-118765
·
Published
2026-10-29
·
Updated
2026-10-29
Description by
CVSS 4.0
7.3
HighMetricsAV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded RNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeeded RNG to mark itself seeded without consulting the configured entropy source. On builds without BOTAN HAS SYSTEM RNG, the fallback uses only a clock value and process ID, so a later non-empty request can produce output from predictable state. This issue is fixed in version 3.13.0.
Found an issue in the description? Have something to add? Feel free to write us 👾