{"id":"CVE-2025-2884","revision":"44facf0728cf46ea9acda86774f9647b","records":[{"revision":"44facf0728cf46ea9acda86774f9647b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-2884","aliases":[],"title":"Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation","description":"TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0","state":0,"publishedAt":"2025-06-10T17:29:19.463+00:00","modifiedAt":"2026-10-15T01:01:59.3+00:00","affected":[{"ecosystem":"Vendor product","name":"TPM2.0","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Trusted Computing Group\",\n                    \"product\": \"TPM2.0\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.83\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://trustedcomputinggroup.org/about/security/","https://trustedcomputinggroup.org/wp-content/uploads/TPM2.0-Library-Spec-v1.83-Errata_v1_pub.pdf","https://trustedcomputinggroup.org/wp-content/uploads/VRT0009-Advisory-FINAL.pdf","https://github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1","https://www.cve.org/CVERecord?id=CVE-2025-49133"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-2884","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-2884","identifiers":["CVE-2025-2884"]},"retained":false,"historicalAffected":[]}],"coverage":[]}