CVE-2025-59321CWE-1188

CVE-2025-59321

Critical · published August 12, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
55.3
In the wild
Unconfirmed
What it is

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed via an unintended execution path or from another hardware platform.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00775 · 55.3th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2026-08-12T19:17Z
References (3)
https://i.blackhat.com/BH-USA-26/Presentations/US-26-Burch-The-Cost-of-Obscurity-Wednesday.pdf · [email protected]https://i.blackhat.com/BH-USA-26/Presentations/US-26-Burch-The-Cost-of-Obscurity-wp.pdf · [email protected]https://www.cpsd.at/blog/ · [email protected]
EPSS history
Timeline
  • 12 AUG 00:00Z
    CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state
    cvelistv5