Out-of-bounds read in tpm2-tss - CVE-2026-73986
Published: November 4, 2026
Vulnerability identifier: #VU159295
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73986
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service and potentially disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the tpm2-tss FAPI IMA event log parser when processing an algorithm name with an unbounded strlen call. A local user can supply a crafted IMA log entry whose d-ng algorithm name lacks a NUL terminator within the event buffer to cause the parser to read beyond the buffer, potentially crashing the application or exposing adjacent memory.
The vulnerable parsing path is reached through ifapi_read_ima_event_log using the configured ima_log_file path.
Affected software
tpm2-tss
How to mitigate CVE-2026-73986
Install security update from vendor's website.
tpm2-tss - addressed in versions 4.1.4, 4.2.0