CVE-2026-85769

Name of the Vulnerable Software and Affected Versions libtpms (affected versions not specified)

Description An issue exists in libtpms, a library for software TPM 2.0 emulation. During the restoration of TPM 2.0 state, such as during virtual machine power-on or migration restore, a malformed state blob can provide an oversized skip-block length. Because this length is not validated against the remaining input buffer size, an internal size counter can become negative. An unsafe signed-to-unsigned conversion then allows the parser to bypass bounds checks and read memory outside the heap buffer. This can lead to a crash of the process hosting the library, such as swtpm, causing a denial of service for the emulated TPM device and the dependent virtual machine.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.