EUVD-2026-56224
GHSA-72rq-994p-w2hw
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
High privileges required to interact with TPM attestation interface; scope change reflects trust-chain impact on external CAs; no availability impact observed.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.
AnalysisAI
Credential forgery via type confusion in the TCG TPM 2.0 reference code (versions through v184) allows a local attacker holding high-privilege access to submit a falsified TPM key - such as an Attestation Key, DevID Key, or TLS authentication key - to a TPM-aware Certificate Authority and receive a legitimate credential for it. With that credential, the attacker can forge subsequent TPM 2.0 attestations, silently undermining the platform integrity guarantees that downstream security controls depend on, including measured boot verification, zero-trust device posture checks, and DevID-based network admission. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the target system with high privileges - administrator or root equivalent - on a platform running a TPM 2.0 implementation derived from the vulnerable TCG reference code at version v184 or earlier (per CVSS AV:L and PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.9 score with a scope-changing vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) captures two competing realities: the attack prerequisites are substantial, yet successful exploitation carries serious cross-system integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the TCG errata for the TPM Library Specification 2.0 available at https://trustedcomputinggroup.org/resource/errata-for-tpm-library-specification-2-0/ and review the full VRT0010 advisory at https://trustedcomputinggroup.org/wp-content/uploads/VRT0010-Advisory_Final-1.pdf; extended implementation-level guidance for downstream vendors is published at https://trustedcomputinggroup.org/wp-content/uploads/Extended-vrt0010-11-guidance_V1.pdf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory systems using TPM attestation for zero-trust or device posture decisions, and audit local administrative access across those systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-704 – Incorrect Type Conversion or Cast
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today