CVE-2026-13199CWE-331

Insufficient Entropy in Raspberry Pi 5 and Compute Module 5

Medium · published July 7, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
5.3
In the wild
Unconfirmed
What it is

EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00164 · 5.3th percentile
Weakness
CWE-331 · Insufficient Entropy
Published
2026-07-07T08:36Z
EPSS history
Timeline
  • 07 JUL 08:36Z
    Insufficient Entropy in Raspberry Pi 5 and Compute Module 5
    cvelistv5