TPM 2.0 CVE-2026-6727

The attacker must have local access to the TPM command interface with the ability to submit arbitrary RSA OAEP decryption commands and precisely measure response timing - on Linux this maps to read/write access to /dev/tpm0 or /dev/tpmrm0, and on Windows to access through the TPM Base Services API. The CVSS vector assigns PR:N, but the description explicitly states 'privileged local attacker,' a discrepancy defenders must resolve by auditing which users and processes hold TPM device access in their environment; treat TPM interface access as the operative exploitation gate. The attack further requires high operational complexity: many repeated queries with fine-grained timing measurement, reflected in AC:H, making opportunistic or automated mass exploitation unlikely. Exploitation is bounded by the following limiting factors: it is strictly local with no network vector, demands substantial query volume which may be detectable via TPM audit logging or anomaly detection on TPM command rates, is limited to RSA OAEP decryption paths rather than all TPM operations, and requires the target system to have TPM-managed RSA keys in active use for the recovered data to be actionable.

The published CVSS 3.1 score of 5.9 (Medium) may understate real-world impact given the cryptographic sensitivity of the targeted assets. The vector AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N reflects a local, high-complexity attack with scope change and high confidentiality loss. A notable discrepancy exists: the description explicitly states 'privileged local attacker,' yet the CVSS assigns PR:N - this suggests OS-level privileges may not be strictly required if TPM device access is available to local users, but defenders should audit actual TPM device permissions in their environment rather than relying on the PR:N assignment. Additionally, the I:N metric does not capture the attestation forgery capability described, which represents a meaningful integrity impact on relying systems and arguably warrants I:L or higher at scope. EPSS at 0.19% (9th percentile) confirms no widespread exploitation activity, and no CISA KEV listing is present. Despite the low probability score, environments where TPM 2.0 attestation underpins remote access, zero-trust network admission, or measured boot integrity should treat this as a higher operational priority than the CVSS score implies.

A local attacker with access to the TPM command interface - for example, a process running under a low-privileged account on a system where /dev/tpm0 is group-readable, or a workload with TPM passthrough in a virtualized environment - submits thousands of crafted RSA OAEP decryption requests and precisely measures response latency for each. By statistically analyzing accumulated timing differences, the attacker recovers sufficient plaintext information to decrypt EK-protected import blobs or credential activation blobs, and may subsequently generate forged platform attestations accepted by remote verifiers. No public exploit code has been identified, and the AC:H rating reflects the significant measurement precision and query volume this attack requires.