TPM2.0 vulnerabilities

2 known vulnerabilities in TPM2.0 from Trusted Computing Group. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.9 High severity

  TPM2.0: Incorrect Type Conversion or Cast

  CVE-2026-6726Aug 11, 2026Trusted Computing Group

  An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS auth

• 7.8 High severity

  TPM2.0: Out-of-bounds Write

  CVE-2023-1017Feb 28, 2023Trusted Computing GroupEPSS 1.38%

  An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of s