#VU120909 Cryptographic issues in libtpms - CVE-2026-21444
Published: January 5, 2026
Vulnerability identifier: #VU120909
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-21444
CWE-ID: CWE-310
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
libtpms
libtpms
Software vendor:
Stefan Berger
Stefan Berger
Description
The vulnerability allows an attacker to potentially decrypt data.
The vulnerability exists due to an error related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps.
Remediation
Install updates from vendor's website.