CVE-2026-21444

MEDIUM EPSS 0.1%
Published Jan 2, 20266mo ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jan 2, 2026 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of libtpms with OpenSSL 3.x contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality. Version 0.10.2 fixes the issue. No known workarounds are available.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
0.1% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-327
CWE-330

Affected Products 1

VendorProductVersionRange
libtpms_projectlibtpms*≥0.10.0  –  <0.10.2

References 3

  • github.com https://github.com/stefanberger/libtpms/commit/33c9ff074cb16c1841ce7d7f33643c17c426743a
    Patch
  • github.com https://github.com/stefanberger/libtpms/issues/541
    ExploitIssue Tracking
  • github.com https://github.com/stefanberger/libtpms/security/advisories/GHSA-7jxr-4j3g-p34f
    PatchVendor Advisory

Remediation

  • github.com https://github.com/stefanberger/libtpms/commit/33c9ff074cb16c1841ce7d7f33643c17c426743a
    Patch
  • github.com https://github.com/stefanberger/libtpms/security/advisories/GHSA-7jxr-4j3g-p34f
    PatchVendor Advisory