SB2026110476 - Multiple vulnerabilities in tpm2-tss
Published: November 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-73980)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service in applications using tpm2-tss.
The vulnerability exists due to an out-of-bounds read in the check_out_string function in src/tss2-fapi/ifapi_eventlog_system.c when processing firmware event-log JSON. A remote attacker can supply an event_data value that is a prefix of an expected token but shorter than that token to cause strncmp to read beyond the allocated heap buffer, potentially crashing the application.
2) Out-of-bounds read (CVE-ID: CVE-2026-73981)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service by triggering an out-of-bounds heap read.
The vulnerability exists due to an out-of-bounds read caused by unchecked response lengths in Tss2_Sys_GetEncryptParam and its ESAPI consumer iesys_decrypt_param when processing TPM responses for an HMAC session with TPMA_SESSION_ENCRYPT set. A local privileged user can control a local software TPM transport and supply a forged response with an inflated parameter length and a valid response HMAC to cause a heap over-read that may crash the calling process.
3) Insufficient verification of data authenticity (CVE-ID: CVE-2026-73982)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass remote attestation verification and have attacker-chosen PCR selections and digests accepted as authentic.
The vulnerability exists due to insufficient verification of data authenticity in the libtss2-fapi Fapi_VerifyQuote API when validating TPM-signed attestations without checking the attest.type discriminator. A remote attacker can submit a non-quote attestation legitimately signed by the attestation key using TPM2_NV_Certify or TPM2_Certify to have it accepted as a valid quote, causing downstream verifiers to interpret non-quote data as PCR selections and digests.
Exploitation requires control of a device with an enrolled attestation key or access to that key's signing capability through a compromised attester; compromise of the key itself is not necessary.
4) Unchecked Return Value (CVE-ID: CVE-2026-73984)
CWE-ID: CWE-252 - Unchecked Return Value
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass policy and attestation checks by causing malformed TPM data to be accepted as valid.
The vulnerability exists due to an unchecked return value in the TPM2B_UNMARSHAL_SUBTYPE macro in src/tss2-mu/tpm2b-types.c when decoding TPM2B subtype payloads. A remote attacker can supply a crafted TPM response with a valid outer size field and a malformed inner subtype to cause partially decoded structures to be accepted as valid, potentially bypassing downstream policy and attestation checks.
5) Stack-based buffer overflow (CVE-ID: CVE-2026-73983)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service and corrupt adjacent stack memory.
The vulnerability exists due to a stack-based buffer overflow caused by unchecked PCRIndex values in the tpm2-tss FAPI firmware eventlog serialization callbacks when processing attacker-controlled firmware eventlogs. A local user can supply an eventlog containing PCRIndex = 32 or PCRIndex = 0xFFFFFFFF to trigger an out-of-bounds read and increment of recnum_tab, causing a process crash or corruption of adjacent stack memory.
6) Out-of-bounds write (CVE-ID: CVE-2026-73985)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory and cause a denial of service, with potential arbitrary code execution depending on memory layout and allocator behavior.
The vulnerability exists due to an out-of-bounds write in the tpm2-tss function ifapi_json_BYTE_array_deserialize() when processing JSON arrays that exceed the output buffer's maximum size. The function detects the excessive array length but continues writing instead of returning an error. A remote attacker can trick a victim into processing a crafted JSON file containing an oversized byte array to overwrite adjacent memory with attacker-controlled bytes and cause a crash or potentially execute arbitrary code.
7) Out-of-bounds read (CVE-ID: CVE-2026-73986)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service and potentially disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the tpm2-tss FAPI IMA event log parser when processing an algorithm name with an unbounded strlen call. A local user can supply a crafted IMA log entry whose d-ng algorithm name lacks a NUL terminator within the event buffer to cause the parser to read beyond the buffer, potentially crashing the application or exposing adjacent memory.
The vulnerable parsing path is reached through ifapi_read_ima_event_log using the configured ima_log_file path.
8) Out-of-bounds write (CVE-ID: CVE-2026-73989)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt memory and cause a denial of service in applications that process attacker-controlled FAPI policies.
The vulnerability exists due to an out-of-bounds write in the ifapi_compute_policy_digest function in src/tss2-fapi/ifapi_helpers.c when computing policy digests using an unchecked PCR index. A local user can supply a crafted policy JSON containing pcrs entries with pcr >= 32 to write past the end of the pcrSelect array, corrupt memory in the calling process, and potentially crash the application.
9) NULL pointer dereference (CVE-ID: CVE-2026-73988)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service by crashing an application that loads or provisions with attacker-controlled FAPI policy JSON.
The vulnerability exists due to a null pointer dereference in the copy_policy_element function in src/tss2-fapi/ifapi_helpers.c when copying a policy that uses currentPCRs or currentPCRandBanks without a pcrs entry. A local user can supply a crafted policy JSON that selects either option and omits pcrs to trigger an unchecked dereference of from_policy->element.PolicyPCR.pcrs and crash the application.
10) Out-of-bounds write (CVE-ID: CVE-2026-73987)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt memory and potentially execute arbitrary code in the context of the calling process.
The vulnerability exists due to an out-of-bounds write in the tpm2-tss iesys_MU_IESYS_SESSION_Unmarshal function when deserializing attacker-controlled ESYS_TR or context blobs through Esys_TR_Deserialize or Esys_ContextLoad. A local user can supply a crafted blob with a sizeSessionValue field exceeding the capacity of the fixed-size sessionValue buffer to overwrite adjacent memory and potentially execute arbitrary code.
11) Out-of-bounds write (CVE-ID: CVE-2026-73990)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or corrupt memory in applications that process attacker-controlled event logs.
The vulnerability exists due to an off-by-one bounds check in the tpm2-tss FAPI event log parser when processing event log entries. A local user can supply a crafted event log with PCRIndex = 32 to trigger out-of-bounds reads or writes to the JSON serializer's recnum_tab[TPM2_MAX_PCRS] array, potentially corrupting memory or crashing the application.
Remediation
Install update from vendor's website.
References
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-q759-vqg7-8rc5
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-7638-f8gq-c475
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-x5j2-26fc-hhc3
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-p3px-r4mm-jpw5
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-gf8g-2r5c-74c7
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-pcpw-8625-jqcp
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-v2qp-xh5m-44mf
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-6grq-c24j-xcjr
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-2q5v-c7hv-fvpf
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-mj78-pj5v-wvjx
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-xqrv-v8rj-v8xw