CVE-2026-118765

Name of the Vulnerable Software and Affected Versions Botan versions 3.7.0 through 3.12.0

Description An issue exists where an application calling AutoSeeded RNG::clear() followed by randomize() with an empty output buffer while the generator is unseeded may cause AutoSeeded RNG to mark itself as seeded without consulting the configured entropy source. In builds where BOTAN HAS SYSTEM RNG is not defined, the fallback mechanism relies solely on a clock value and process ID, potentially leading to predictable output in subsequent non-empty requests.

Recommendations Update to version 3.13.0.