{"id":"CVE-2026-6726","aliases":["DEBIAN-CVE-2026-6726","EUVD-2026-56224","GHSA-72rq-994p-w2hw","UBUNTU-CVE-2026-6726"],"status":"published","title":"An information leakage vulnerability in the TCG TPM 2.0 reference code.","description":"An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key.  See also TCG VRT0010.","severity":{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00192,"percentile":0.08945,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-704"],"published":"2026-08-11T15:24:44Z","modified":"2026-10-25T09:47:41Z","fixes":[{"ecosystem":"Debian:12","package":"libtpms","fixed_in":["0.9.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libtpms","fixed_in":["0.9.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libtpms","fixed_in":["0.9.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-1"}]}]}],"products":[{"vendor":"trusted computing group","product":"tpm2.0"}],"references":[{"url":"https://trustedcomputinggroup.org/resource/errata-for-tpm-library-specification-2-0/","tags":["report"]},{"url":"https://trustedcomputinggroup.org/wp-content/uploads/VRT0010-Advisory_Final-1.pdf","tags":["report"]},{"url":"https://trustedcomputinggroup.org/wp-content/uploads/Extended-vrt0010-11-guidance_V1.pdf","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6726"},{"url":"https://trustedcomputinggroup.org/resource/errata-for-tpm-library-specification-2-0"},{"url":"https://github.com/advisories/GHSA-72rq-994p-w2hw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6726","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6726","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6726","tags":["report"]},{"url":"https://groups.google.com/g/libtpms-announce/c/xB2PqSQRA_8","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-6726","title":"An information leakage vulnerability in the TCG TPM 2.0 reference code.","description":"An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key.  See also TCG VRT0010.","status":"published","published":"2026-08-11T15:24:44.88Z","modified":"2026-08-12T19:18:15.598Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T13:49:53.818886Z"}],"euvd":[{"id":"EUVD-2026-56224","description":"An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key.  See also TCG VRT0010.","status":"published","published":"2026-08-11T15:24:44Z","modified":"2026-08-12T19:18:15Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:57.602969Z"}],"ghsa":[{"id":"GHSA-72rq-994p-w2hw","title":"An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could...","description":"An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key.  See also TCG VRT0010.","status":"published","published":"2026-08-11T18:30:48Z","modified":"2026-08-12T21:32:30Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T15:10:23.958572Z"}],"nvd":[{"id":"CVE-2026-6726","description":"An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key.  See also TCG VRT0010.","status":"published","published":"2026-08-11T16:17:34.397Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T14:12:36.499002Z"}],"osv":[{"id":"DEBIAN-CVE-2026-6726","description":"An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key.  See also TCG VRT0010.","status":"published","published":"2026-08-11T16:17:34.397Z","modified":"2026-10-25T09:47:41.098082324Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:01.68444Z"},{"id":"UBUNTU-CVE-2026-6726","description":"An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key.  See also TCG VRT0010.","status":"withdrawn","published":"2026-08-11T16:17:00Z","modified":"2026-09-29T17:33:23.831489702Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:53.710209Z"}]}}