VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks
CERT/CC discloses two TPM 2.0 reference code flaws allowing RSA key decryption and forged TPM attestations via crafted commands.
CERT/CC published VU#431093 covering two vulnerabilities in the TCG TPM 2.0 reference implementation: CVE-2026-6726 (information leakage via falsified TPM keys) and CVE-2026-6727 (timing side-channel in RSA OAEP decryption). An attacker with privileged access to a TPM command interface could send crafted TPM commands to decrypt ciphertexts for affected TPM-managed RSA keys, including the RSA Endorsement Key, or obtain credentials enabling forged TPM 2.0 attestations. Remediation is tracked in TCGVRT010 and TCGVRT0011.
- CVE-2026-6726 leaks information via falsified TPM keys
- CVE-2026-6727 is a timing side-channel in RSA OAEP decryption
- Enables decryption of TPM-managed RSA keys and forged attestations
- Requires privileged access to the TPM command interface
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-6726 | Info Leak in TCG TPM 2.0 Reference Code Enables Attestation Key Forgery | 7.9 | <1% | ||
| CVE-2026-6727 | Timing Side-Channel in TCG TPM 2.0 Reference Code RSA-OAEP Decryption | 5.9 | <1% |
From the original article
Overview Two vulnerabilities have been identified in the Trusted Platform Module (TPM) 2. 0 reference implementation: CVE-2026-6726 – Information leakage via falsified TPM keys. CVE-2026-6727 – A timing side-channel vulnerability in RSA OAEP decryption.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.