CVE-2025-66442: 
Mbed TLS vulnerability analysis and mitigation

CVE-2025-66442 is a compiler-induced timing side-channel vulnerability in Mbed TLS through version 4.0.0 and TF-PSA-Crypto through version 1.0.0, affecting RSA and CBC/ECB decryption operations. The flaw is triggered exclusively when the affected libraries are compiled using LLVM's select-optimize feature, which inadvertently introduces non-constant-time code paths in cryptographic operations. It was published on April 1, 2026, and carries a CVSS v3.1 base score of 5.1 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-385 (Covert Timing Channel): LLVM's select-optimize compiler pass transforms constant-time conditional operations into variable-time branches, breaking the constant-time guarantees that Mbed TLS's RSA and CBC/ECB decryption implementations rely upon. This is a build-time issue — the vulnerability only manifests in binaries compiled with LLVM when the select-optimize optimization is active, not in all deployments. An attacker with local access can measure execution timing differences during decryption operations to infer secret key material through statistical analysis, consistent with CAPEC-462 (Cross-Domain Search Timing) (Github Advisory, Mbed TLS Advisory).

Successful exploitation allows a local attacker to extract private RSA keys and symmetric encryption keys (used in CBC/ECB modes) through timing analysis, resulting in a high confidentiality impact with no integrity or availability impact. The attack is limited to the local system and requires the target software to have been compiled with LLVM's select-optimize feature enabled. Compromised private keys could enable downstream attacks such as decryption of previously captured ciphertext, impersonation, or man-in-the-middle attacks in TLS sessions (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.025% per GitHub Advisory), placing it in the 7th percentile for exploitation likelihood. Exploitation requires local access and the specific build condition of LLVM's select-optimize being active, significantly limiting the practical attack surface (Github Advisory).

Patches are available in Mbed TLS 3.6.6 and 4.1.0, and TF-PSA-Crypto 1.1.0, all released on March 31, 2026 — users should upgrade to these versions (Mbed TLS Releases, TF-PSA-Crypto Releases). As an immediate workaround, organizations should review their build toolchain and disable LLVM's select-optimize feature when compiling Mbed TLS or TF-PSA-Crypto. Deployments not using LLVM or not enabling select-optimize are not affected and do not require urgent action (Mbed TLS Advisory).

The Mbed TLS project published a dedicated security advisory titled "Compiler-induced constant-time violations" as part of the coordinated release of Mbed TLS 3.6.6 and 4.1.0, acknowledging the issue as one of multiple security fixes in those releases (Mbed TLS Advisory). The vulnerability was detected by Qualys scanners (detection ID 692272) and is tracked by ENISA under EUVD-2025-209171 (Feedly). No significant broader community or social media discussion has been observed beyond standard vulnerability tracking.