A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. (CVE-2026-6924)
A vulnerability in the entropy initialization for SiWx917 causes the deterministic random bit generator (DRBG) to use a predictable seed. This results in all random numbers generated in the Matter code using the same predictable stream. The affected repository was already deprecated when this issue was discovered.
AI Analysis
Technical Summary
CVE-2026-6924 describes a weakness in the entropy initialization process for the SiWx917 device, causing the DRBG to generate random numbers from a predictable seed. This predictability compromises the randomness of all numbers generated within the Matter codebase that relies on this DRBG. The vulnerability relates to CWE-336 (Incorrect Entropy Initialization). No patch or remediation is currently indicated, and the impacted code repository is deprecated.
Potential Impact
Because the DRBG uses a predictable seed, all random numbers generated are predictable, which can undermine cryptographic operations relying on randomness within the Matter code. This can lead to potential compromise of security features that depend on secure random number generation. However, no known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the impacted repository is deprecated, users should consider migrating to supported codebases or implementations that do not exhibit this vulnerability.
A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. (CVE-2026-6924)
Description
A vulnerability in the entropy initialization for SiWx917 causes the deterministic random bit generator (DRBG) to use a predictable seed. This results in all random numbers generated in the Matter code using the same predictable stream. The affected repository was already deprecated when this issue was discovered.
CVSS v4.0
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-6924 describes a weakness in the entropy initialization process for the SiWx917 device, causing the DRBG to generate random numbers from a predictable seed. This predictability compromises the randomness of all numbers generated within the Matter codebase that relies on this DRBG. The vulnerability relates to CWE-336 (Incorrect Entropy Initialization). No patch or remediation is currently indicated, and the impacted code repository is deprecated.
Potential Impact
Because the DRBG uses a predictable seed, all random numbers generated are predictable, which can undermine cryptographic operations relying on randomness within the Matter code. This can lead to potential compromise of security features that depend on secure random number generation. However, no known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the impacted repository is deprecated, users should consider migrating to supported codebases or implementations that do not exhibit this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wm5h-r2qh-r97h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-6924"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a629b0d9c2644c7f8d861be
Added to database: 07/23/2026, 22:51:57 UTC
Last enriched: 07/23/2026, 22:52:14 UTC
Last updated: 07/24/2026, 03:48:00 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.