diff --git a/ChangeLog.d/fix-psa-ffdh-buffer-overflow.txt b/ChangeLog.d/fix-psa-ffdh-buffer-overflow.txt
new file mode 100644
index 0000000000..0c33742bab
--- /dev/null
+++ b/ChangeLog.d/fix-psa-ffdh-buffer-overflow.txt
@@ -0,0 +1,7 @@
+Security
+   * Fix a buffer overflow in psa_export_public_key() for FFDH keys.
+     Previously we calculated the key length and wrote that much data to the
+     output buffer, regardless of the output buffer length. Fix this by always
+     checking that the key length is less than the output buffer length before
+     performing the copy and return PSA_ERROR_BUFFER_TOO_SMALL if the output
+     buffer is too small.