CVE-2026-85769
Received Received - Intake

Heap Buffer Overflow in libtpms TPM 2.0 Emulation

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: redhat-SADP

Description
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, which bypasses a subsequent bounds check due to an unsafe signed-to-unsigned conversion, causing the parser to read memory outside the bounds of the heap buffer holding the state data. Successful exploitation can crash the process hosting libtpms (such as swtpm), resulting in a denial of service of the emulated TPM device and the virtual machine that depends on it. No data corruption or information disclosure was confirmed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85769
EUVD
EUVD-2026-71627

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in libtpms, a library that emulates a TPM 2.0 device. When restoring the TPM state, a malformed input can trick the parser into reading memory outside the allocated buffer. This happens because an invalid length value causes a counter to go negative, bypassing a bounds check. The result is a crash of the process hosting libtpms, like swtpm, leading to a denial of service for the virtual machine relying on the emulated TPM.

Detection Guidance

This vulnerability involves a flaw in libtpms during TPM 2.0 state restoration. Detection requires checking for vulnerable libtpms versions and monitoring for crashes in processes like swtpm during VM operations.

Impact Analysis

If you use virtual machines with TPM 2.0 emulation via libtpms, this flaw could crash the emulated TPM device and the virtual machine. This results in a denial of service, disrupting services that depend on the TPM, such as secure boot or cryptographic operations.

Mitigation Strategies

Update libtpms to the latest patched version immediately. Restrict access to virtual machines using libtpms and monitor for unusual crashes or memory corruption during state restoration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85769. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart