CVE-2026-85769

CVE-2026-85769 قراءة خارج الحدود من الكومة في libtpms عند إلغاء تسلسل الحالة المتطايرة TPM 2.0. تخطّي كتلة اختيارية غير محدود في blockskipread يقدّم مؤشر إلغاء الترميز بمقدار طول 16-بت يتحكم به المهاجم ويدفع عداد الحجم المتبقي الموقّع إلى قيمة سالبة. عندها تنجح جميع فحوصات الحدود اللاحقة، لأنها...

CVE-2026-85769

A heap out-of-bounds read in libtpms (software TPM 2.0 emulation, commonly deployed via swtpm in virtual machines) occurs during TPM 2.0 volatile-state restoration. An attacker-controlled oversized skip-block length in block_skip_read() drives a signed size counter negative; a subsequent signed-t...

CVE-2026-85769 Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...