Insufficient verification of data authenticity in tpm2-tss - CVE-2026-73982
Published: November 4, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass remote attestation verification and have attacker-chosen PCR selections and digests accepted as authentic.
The vulnerability exists due to insufficient verification of data authenticity in the libtss2-fapi Fapi_VerifyQuote API when validating TPM-signed attestations without checking the attest.type discriminator. A remote attacker can submit a non-quote attestation legitimately signed by the attestation key using TPM2_NV_Certify or TPM2_Certify to have it accepted as a valid quote, causing downstream verifiers to interpret non-quote data as PCR selections and digests.
Exploitation requires control of a device with an enrolled attestation key or access to that key's signing capability through a compromised attester; compromise of the key itself is not necessary.