CVE-2026-6726CWE-704

CVE-2026-6726

High · published August 11, 2026

CVSS v3.1
7.9
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.

The record
Technical detail
CVSS v3.1
7.9 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.4th percentile
Weakness
CWE-704 · Incorrect Type Conversion or Cast
Published
2026-08-11T20:17Z
References (3)
https://trustedcomputinggroup.org/resource/errata-for-tpm-library-specification-2-0/ · [email protected]https://trustedcomputinggroup.org/wp-content/uploads/Extended-vrt0010-11-guidance_V1.pdf · [email protected]https://trustedcomputinggroup.org/wp-content/uploads/VRT0010-Advisory_Final-1.pdf · [email protected]
EPSS history
Timeline
  • 11 AUG 15:24Z
    An information leakage vulnerability in the TCG TPM 2.0 reference code.
    cvelistv5