CVE-2026-118765: Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state
Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeededRNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeededRNG to mark itself seeded without consulting the configured entropy source. On builds without BOTANHASSYSTEMRNG, the fallback uses only a clock value and process ID, so a later non-empty request can produce output from predictable state. This issue is fixed in version 3.13.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Botanto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
Which applications are realistically exposed to predictable output?
Affected applications use Botan 3.7.0 through 3.12.0, call AutoSeeded_RNG::clear(), then call randomize with an empty output buffer while the generator is unseeded. Predictable state is specifically possible on builds without BOTAN_HAS_SYSTEM_RNG.
What must occur for exploitation to be possible?
The application must clear the AutoSeeded_RNG state and make an empty-buffer randomize call before a later non-empty random-output request. In a build without BOTAN_HAS_SYSTEM_RNG, the fallback seed then uses only a clock value and process ID.
Are builds with a system RNG affected in the same way?
The described predictable fallback applies to builds without BOTAN_HAS_SYSTEM_RNG. The issue can still cause the generator to be marked seeded without consulting the configured entropy source, but the provided information does not state that system-RNG-enabled builds produce predictable output.
What is the available remediation?
Update Botan to version 3.13.0, which fixes the issue. If an immediate update is not possible, avoid the sequence of clearing AutoSeeded_RNG followed by randomize with an empty output buffer while it is unseeded.