CVE-2025-2884mediumCWE-125

CVE-2025-2884: falha de média gravidade em Trusted Computing Group TPM2.0

Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar TPM2.0

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.6epss 0.3%
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Produtos afetados
Trusted Computing Group · TPM2.0
CVEs relacionadas — Trusted Computing Group TPM2.0

No mesmo produto, das mais perigosas para as menos.

CVE-2023-1018MEDIUMTPM2.0 vulnerable to out-of-bounds read EPSS 5.6%CVE-2023-1017—TPM2.0 vulnerable to out-of-bounds writeEPSS 1.4%CVE-2026-6726HIGHAn information leakage vulnerability in the TCG TPM 2.0 reference code.EPSS 0.2%CVE-2026-6727MEDIUMCVE-2026-6727EPSS 0.2%