Vulnerability in libspdm Affects DMTF SPDM Implementation
CVE-2026-61810

6MEDIUM

Key Information:

Vendor

Dmtf

Status
Libspdm
Vendor
CVE Published:
11 November 2026

What is CVE-2026-61810?

In version 1.4.0 of libspdm, the implementation of DMTF SPDM specifications introduced new fields in the FINISH request and response. The omission in the update of the transcript definitions for the FINISH signature resulted in a vulnerability where an active attacker could potentially manipulate the opaque data in transit without detection. This flaw arises because the signature/HMAC is not adequately computed over all transmitted fields, compromising the integrity of the handshake process. The issue has been rectified in version 1.4.1.

Affected Version(s)

libspdm = 1.4.0

References

https://github.com/DMTF/libspdm/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/DMTF/libspdm/issues/3633
x_refsource_MISC

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.