DEBIAN-CVE-2026-75900
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-75900
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-75900.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-75900
- Upstream
- Published
- 2026-08-19T08:17:14Z
- Modified
- 2026-09-14T17:03:55Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.
- References
Affected packages
Debian:12 / swtpm
Package
- Name
- swtpm
- Purl
- pkg:deb/debian/swtpm?arch=source&distro=bookworm
Debian:13 / swtpm
Package
- Name
- swtpm
- Purl
- pkg:deb/debian/swtpm?arch=source&distro=trixie
Debian:14 / swtpm
Package
- Name
- swtpm
- Purl
- pkg:deb/debian/swtpm?arch=source&distro=forky