Out-of-Bounds Read Vulnerability in swtpm Product by Red Hat

CVE-2026-75900

What is CVE-2026-75900?

An out-of-bounds read vulnerability exists in the SWTPM_NVRAM_CheckHeader() function of swtpm. This vulnerability arises from a faulty buffer validation check, where the length of the buffer is incorrectly validated against the pointer size instead of the actual struct size. Consequently, this may allow an undersized buffer to bypass validation measures, leading to a 2-byte heap overread on 64-bit systems, or 6 bytes on 32-bit systems, when accessing the totlen field. The potential consequences include daemon termination in certain environments and leakage of sensitive heap data into logs, emphasizing the importance of immediate attention to this security issue.

References