SUSE-SU-2026:4278-1 Security update for libtpms

This update for libtpms fixes the following issues: - CVE-2025-49133: inconsistent parameter handling can cause out-of-bounds reads bsc1244528. - CVE-2026-85769: heap out-of-bounds read in TPM2 state unmarshalling via unchecked blockskipread blocksize bsc1279628...

CVE-2026-85769

CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0 volatile-state deserialization. An unbounded optional-block skip in blockskipread advances the unmarshal cursor by an attacker-controlled 16-bit length and drives the signed remaining-size counter negative. Every downstream bounds check th...

CVE-2026-85769 Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...

CVE-2026-85769 Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...

CVE-2026-85769

A heap out-of-bounds read in libtpms (software TPM 2.0 emulation, commonly deployed via swtpm in virtual machines) occurs during TPM 2.0 volatile-state restoration. An attacker-controlled oversized skip-block length in block_skip_read() drives a signed size counter negative; a subsequent signed-t...