CVE-2025-2884 — Out-of-bounds Read in Computing Group Tpm2.0
Severity
6.6MEDIUMNVD
EPSS
0.1%
top 78.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 10
Latest updateOct 14
Description
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:HExploitability: 1.3 | Impact: 5.2
Affected Packages8 packages
🔴Vulnerability Details
1📋Vendor Advisories
1Microsoft▶
Cert CC: CVE-2025-2884 Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation↗2025-10-14