diff --git a/ChangeLog b/ChangeLog
index 8eb43fe..309a4ec 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,18 @@
 Mbed TLS ChangeLog (Sorted per branch, date)
 
+= Mbed TLS x.x.x branch released xxxx-xx-xx
+
+Security
+   * Fix a buffer overflow in mbedtls_pk_write_pubkey(),
+     mbedtls_pk_write_pubkey_der(), mbedtls_pk_write_pubkey_pem(),
+     mbedtls_pk_write_key_der() and mbedtls_pk_write_key_pem().
+     With MBEDTLS_USE_PSA_CRYPTO turned on, these functions would
+     write to a location before the start of the output buffer if it was less
+     than the size of the key being written and also less than
+     PK_MAX_EC_PUBLIC_KEY_SIZE (for EC public keys) and
+     PSA_EXPORT_KEY_PAIR_MAX_SIZE (for RSA private keys).
+     This buffer overflow only occurs for keys with the type MBEDTLS_PK_OPAQUE.
+
 = Mbed TLS 3.6.1 branch released 2024-08-30
 
 API changes