CVE-2025-54764: Medium severity Arm mbed TLS vulnerability
Published Oct 20, 2025
·Updated
Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtlsmpimodinv or mbedtlsmpigcd.
Affected Software
2 affected components
Arm mbed TLS<3.6.5
Arm mbed TLS<3.6.5
Event History
Oct 20, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-54764?
CVE-2025-54764 is classified as a medium severity vulnerability due to its potential for local timing attacks.
2
How do I fix CVE-2025-54764?
To fix CVE-2025-54764, upgrade to Mbed TLS version 3.6.5 or later.
3
What types of operations are affected by CVE-2025-54764?
CVE-2025-54764 affects certain RSA operations, specifically involving mbedtls_mpi_mod_inv and mbedtls_mpi_gcd.
4
Who is affected by CVE-2025-54764?
Any users of Mbed TLS versions prior to 3.6.5 are potentially affected by CVE-2025-54764.
5
How can I identify if I am using a vulnerable version related to CVE-2025-54764?
You can identify your version of Mbed TLS by checking the version information in the library's documentation or within the implementation.