Cryptography Library Vulnerability in Botan Affects Multiple Versions
CVE-2026-118765
7.3HIGH
What is CVE-2026-118765?
The Botan library, versions 3.7.0 to 3.13.0, contains a vulnerability in its AutoSeeded_RNG component. If an application calls the clear() method followed by randomize() with an empty output buffer while the generator is unseeded, it may incorrectly mark itself as seeded without evaluating the designated entropy source. In environments lacking BOTAN_HAS_SYSTEM_RNG, this fallback relies solely on a clock value and process ID, leading to the potential for predictable random number generation. This flaw has been rectified in version 3.13.0.
Affected Version(s)
botan >= 3.7.0, < 3.13.0