CVE-2026-6726

EUVD-2026-56224
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key.  See also TCG VRT0010.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.9 HIGH
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.87%
Windows Releases
Platform
Version
Windows 10
1607 (x64, x86)
KB5120418
1809 (x64, x86)
KB5120238
21H2 (arm64, x64, x86)
KB5120249
22H2 (arm64, x64, x86)
KB5120249
Windows 11
23H2 (arm64, x64)
KB5120240
24H2 (arm64, x64)
KB5123273
25H2 (arm64, x64)
KB5123273
26H1 (arm64, x64)
KB5121000
Windows Server 2019
Server Core
KB5120238
Standard
KB5120238
Windows Server 2022
Server Core
KB5123303
Standard
KB5123303
Windows Server 2025
Server Core
KB5120233
Standard
KB5120233
Debian logo
Debian Releases
Debian Product
Codename
libtpms
bookworm
0.9.2-3.1+deb12u1
fixed
bookworm (security)
0.9.2-3.1~deb12u1
fixed
forky
0.10.2-5
fixed
sid
0.10.2-5
fixed
trixie
0.9.2-3.2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libtpms
jammy
needs-triage
noble
needs-triage
resolute
not-affected
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://trustedcomputinggroup.org/resource/errata-for-tpm-library-specification-2-0/
https://trustedcomputinggroup.org/wp-content/uploads/Extended-vrt0010-11-guidance_V1.pdf
https://trustedcomputinggroup.org/wp-content/uploads/VRT0010-Advisory_Final-1.pdf