Every CVE Search/ Get API key

CVE-2026-75900

Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch

6.1 MediumFix available

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
High

Exploit likelihood

0.11%Unchanged since Aug 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

Record
CVE-2026-75900
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-06
EUVDEUVD-2026-62363 6.1

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

Record
EUVD-2026-62363
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-06
GitHub AdvisoriesGHSA-gqrg-h59c-j4wj 6.1

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The...

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

Record
GHSA-gqrg-h59c-j4wj
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 6.1

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

Record
CVE-2026-75900
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-06
OSVALPINE-CVE-2026-75900 6.1

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

Record
ALPINE-CVE-2026-75900
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-03
OSVDEBIAN-CVE-2026-75900 6.1

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

Record
DEBIAN-CVE-2026-75900
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-06
Show 9 moreShow less
OSVUBUNTU-CVE-2026-75900 6.1

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

Record
UBUNTU-CVE-2026-75900
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVAZL-96876 No score

CVE-2026-75900 affecting package swtpm for versions less than 0.8.1-6

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

Record
AZL-96876
Updated
2026-11-05
OSVopenSUSE-SU-2026:11598-1 No score

swtpm-0.10.2-1.1 on GA media

These are all security issues fixed in the swtpm-0.10.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11598-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22048-1 No score

Security update for swtpm

This update for swtpm fixes the following issues:

Security issue fixed:

  • CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch (bsc#1275653).

Changes for swtpm:

Update to 0.10.2:

  • Properly check for truncation following snprintf call
  • add upstream signing key and validate source signature
  • Fix SELinux policy for virtqemud_t swtpm_t setsched process and unix socket interactions. Allows virtqemud_t to: Signal and control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched), create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339). Already accepted on upstream: https://github.com/stefanberger/swtpm/pull/1132
  • Drop tunable in require to avoid policy loading issues with toolchain 3.11 (bsc#1271417). Can be dropped, once this is accepted upstream: https://github.com/stefanberger/swtpm/pull/1139
  • Update SELinux module dir as macro to allow root path move from /var/lib/selinux to /etc/selinux (bsc#1221342)
  • Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)
  • Update to version 0.10.1:
  • swtpm: Fix build error on 32bit systems due to inconsistent _FILE_OFFSET_BITS.
  • swtpm_setup:
  • Use DISTRO_PROFILES_DIR when listing profiles (fix path issue).
  • Do not pass a TPM 2 profile to swtpm when reconfiguring.
  • selinux:
  • Add rule for swtpm to be able to read password from pipe.
  • allow to map state file.
  • add NFS permissions for swtpm_t.
  • Add rule to allow swtpm_t opening of virt_log_t files.
Record
openSUSE-SU-2026:22048-1
Updated
2026-11-02
OSVSUSE-SU-2026:23879-1 No score

Security update for swtpm

This update for swtpm fixes the following issue:

  • CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch (bsc#1275653).
Record
SUSE-SU-2026:23879-1
Updated
2026-11-02
OSVSUSE-SU-2026:23927-1 No score

Security update for swtpm

This update for swtpm fixes the following issue:

  • CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch (bsc#1275653).
Record
SUSE-SU-2026:23927-1
Updated
2026-11-02
OSVSUSE-SU-2026:24114-1 No score

Security update for swtpm

This update for swtpm fixes the following issues:

Security issue fixed:

  • CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch (bsc#1275653).

Changes for swtpm:

Update to 0.10.2:

  • Properly check for truncation following snprintf call
  • add upstream signing key and validate source signature
  • Fix SELinux policy for virtqemud_t swtpm_t setsched process and unix socket interactions. Allows virtqemud_t to: Signal and control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched), create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339). Already accepted on upstream: https://github.com/stefanberger/swtpm/pull/1132
  • Drop tunable in require to avoid policy loading issues with toolchain 3.11 (bsc#1271417). Can be dropped, once this is accepted upstream: https://github.com/stefanberger/swtpm/pull/1139
  • Update SELinux module dir as macro to allow root path move from /var/lib/selinux to /etc/selinux (bsc#1221342)
  • Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)
  • Update to version 0.10.1:
  • swtpm: Fix build error on 32bit systems due to inconsistent _FILE_OFFSET_BITS.
  • swtpm_setup:
  • Use DISTRO_PROFILES_DIR when listing profiles (fix path issue).
  • Do not pass a TPM 2 profile to swtpm when reconfiguring.
  • selinux:
  • Add rule for swtpm to be able to read password from pipe.
  • allow to map state file.
  • add NFS permissions for swtpm_t.
  • Add rule to allow swtpm_t opening of virt_log_t files.
Record
SUSE-SU-2026:24114-1
Updated
2026-11-02
OSVSUSE-SU-2026:24156-1 No score

Security update for swtpm

This update for swtpm fixes the following issues:

Security issue fixed:

  • CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch (bsc#1275653).

Changes for swtpm:

Update to 0.10.2:

  • Properly check for truncation following snprintf call
  • add upstream signing key and validate source signature
  • Fix SELinux policy for virtqemud_t swtpm_t setsched process and unix socket interactions. Allows virtqemud_t to: Signal and control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched), create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339). Already accepted on upstream: https://github.com/stefanberger/swtpm/pull/1132
  • Drop tunable in require to avoid policy loading issues with toolchain 3.11 (bsc#1271417). Can be dropped, once this is accepted upstream: https://github.com/stefanberger/swtpm/pull/1139
  • Update SELinux module dir as macro to allow root path move from /var/lib/selinux to /etc/selinux (bsc#1221342)
  • Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)
  • Update to version 0.10.1:
  • swtpm: Fix build error on 32bit systems due to inconsistent _FILE_OFFSET_BITS.
  • swtpm_setup:
  • Use DISTRO_PROFILES_DIR when listing profiles (fix path issue).
  • Do not pass a TPM 2 profile to swtpm when reconfiguring.
  • selinux:
  • Add rule for swtpm to be able to read password from pipe.
  • allow to map state file.
  • add NFS permissions for swtpm_t.
  • Add rule to allow swtpm_t opening of virt_log_t files.
Record
SUSE-SU-2026:24156-1
Updated
2026-11-02
OSVSUSE-SU-2026:4366-1 No score

Security update for swtpm

This update for swtpm fixes the following issue:

  • CVE-2026-75900: out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch (bsc#1275653).
Record
SUSE-SU-2026:4366-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
swtpm
Alpine:v3.21
 before 0.10.2
0.10.2
swtpm
Alpine:v3.22
 before 0.10.2
0.10.2
swtpm
Alpine:v3.23
 before 0.10.2
0.10.2
swtpm
Alpine:v3.24
 before 0.10.2
0.10.2
swtpm
Azure Linux:3
 before 0.8.1-6
0.8.1-6
swtpm
Debian:12
 All versions, plus listed versions
0.10.1+ds-10.10.2-10.10.2-20.7.1-1.30.7.1-1.40.7.1-1.5
 None known
swtpm
Debian:13
 All versions, plus listed versions
0.10.1+ds-10.10.2-10.10.2-20.7.1-1.5
 None known
swtpm
Debian:14
 before 0.10.2-1, plus listed versions
0.10.1+ds-10.7.1-1.5
0.10.2-1
swtpm
SUSE:Linux Micro 6.0
 before 0.8.0-2.1
0.8.0-2.1
swtpm
SUSE:Linux Micro 6.1
 before 0.9.0-slfo.1.1_3.1
0.9.0-slfo.1.1_3.1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
swtpm
SUSE:Linux Micro 6.2
 before 0.10.2-160000.1.1
0.10.2-160000.1.1
swtpm
SUSE:Linux Enterprise Server 16.0
 before 0.10.2-160000.1.1
0.10.2-160000.1.1
swtpm
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 0.10.2-160000.1.1
0.10.2-160000.1.1
swtpm
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 0.9.0-150700.3.3.1
0.9.0-150700.3.3.1
swtpm
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.6.1-0ubuntu10.6.1-0ubuntu20.6.1-0ubuntu30.6.1-0ubuntu40.6.1-0ubuntu5
Show 6 moreShow less
0.6.3-0ubuntu10.6.3-0ubuntu20.6.3-0ubuntu30.6.3-0ubuntu3.10.6.3-0ubuntu3.20.6.3-0ubuntu3.3
 None known
swtpm
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.7.3-0ubuntu20.7.3-0ubuntu30.7.3-0ubuntu50.7.3-0ubuntu5.24.04.1
 None known
swtpm
Ubuntu:26.10
 All versions, plus listed versions
0.10.1+ds-1ubuntu30.10.1+ds-1ubuntu4
 None known
swtpm
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.7.3-0ubuntu80.7.3-0ubuntu90.10.1+ds-1ubuntu20.10.1+ds-1ubuntu3
 None known
swtpm
openSUSE:Tumbleweed
 before 0.10.2-1.1
0.10.2-1.1
swtpm
openSUSE:Leap 16.0
 before 0.10.2-160000.1.1
0.10.2-160000.1.1

History

History
RecordedChangedSources
affectedCVE List, EUVD, NVD, OSV
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-75900 is a medium vulnerability (CVSS 6.1) in Red Hat Enterprise Linux 10, published August 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in swtpm 0.10.2.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open