Description
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
References8
- github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a…
- trustedcomputinggroup.org/about/security/
- trustedcomputinggroup.org/wp-content/uploads/TPM2.0-Library-Spe…
- trustedcomputinggroup.org/wp-content/uploads/VRT0009-Advisory-F…
- www.cve.org/CVERecord?id=CVE-2025-49133
- www.intel.com/content/www/us/en/security-center/advisory/intel-…
- www.kb.cert.org/vuls/id/282450
- cert-portal.siemens.com/productcert/html/ssa-628843.html
Metrics
- CVSS 3.1
-
6.6
MEDIUM
Score source: CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - EPSS — exploit probability
- 0% percentile: 17 · as of 7 November 2026
- CWE
- CWE-125
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.