CVE-2026-6727

EUVD-2026-56223

11.08.2026, 16:17

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.9 MEDIUM	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 3.67%

Windows Releases

Platform

Version

Windows 10

1607 (x64, x86)	KB5120418
1809 (x64, x86)	KB5120238
21H2 (arm64, x64, x86)	KB5120249
22H2 (arm64, x64, x86)	KB5120249

Windows 11

23H2 (arm64, x64)	KB5120240
24H2 (arm64, x64)	KB5121003
25H2 (arm64, x64)	KB5121003
26H1 (arm64, x64)	KB5121000

Windows Server 2019

Server Core	KB5120238
Standard	KB5120238

Windows Server 2022

Server Core	KB5123303
Standard	KB5123303

Windows Server 2025

Server Core	KB5120233
Standard	KB5120233

Debian Releases

Debian Product

Codename

libtpms

bookworm	unimportant
bookworm (security)	unimportant
forky	unimportant
sid	unimportant
trixie	unimportant

Ubuntu Releases

Ubuntu Product

Codename

libtpms

jammy	needs-triage
noble	needs-triage
resolute	needs-triage

Common Weakness Enumeration

CWE-208 - Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Vulnerability Media Exposure

[GERMAN] Microsoft Windows Produkte: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2016, Microsoft Windows 10, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Exchange, Microsoft Windows 11, Microsoft Windows Server 2025 und Microsoft Windows ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
Published: 2026-08-11T22:00:00+00:00

References

https://trustedcomputinggroup.org/about/security/

https://trustedcomputinggroup.org/wp-content/uploads/Extended-vrt0010-11-guidance_V1.pdf

https://trustedcomputinggroup.org/wp-content/uploads/VRT0011-Advisory_Final-1.pdf