CVE-2025-2884
Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
- Record
CVE-2025-2884- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2025-17717
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
- Record
EUVD-2025-17717- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3fxc-2crv-fg9x
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of...
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata 1.83 of TCG standard TPM2.0
- Record
GHSA-3fxc-2crv-fg9x- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
- Record
CVE-2025-2884- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
- Record
CVE-2025-2884- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Affected products
- trusted computing group tpm2.0
- siemens simatic cn 4100
- siemens simatic field pg m5
- siemens simatic field pg m6
- siemens simatic ipc bx-32a
- siemens simatic ipc bx-39a
- siemens simatic ipc bx-56a
- siemens simatic ipc bx-59a
- siemens simatic ipc md-57a
- siemens simatic ipc px-32a
- siemens simatic ipc px-39a
- siemens simatic ipc px-39a pro
Show 13 moreShow less
- siemens simatic ipc rw-528a
- siemens simatic ipc rw-548a
- siemens simatic ipc227e
- siemens simatic ipc277e
- siemens simatic ipc427e
- siemens simatic ipc477e
- siemens simatic ipc477e pro
- siemens simatic ipc627e
- siemens simatic ipc647e
- siemens simatic ipc677e
- siemens simatic ipc847e
- siemens simatic itp1000
- siemens siplus ipc427e
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-2884 is a medium vulnerability (CVSS 6.6) in Trusted Computing Group Tpm2.0, published June 10, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. No source names a fixed version.
References
trustedcomputinggroup.org/about/security
github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1
cve.org/CVERecord?id=CVE-2025-49133
intel.com/content/www/us/en/security-center/advisory/intel-sa-01209.html