CVE-2026-6727

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may exploit timing differences to recover information used to decrypt ciphertexts encrypted to TPM-managed RSA keys, such as the RSA Endorsement Key (EK), import blobs, credential blobs, and session salts. Under certain conditions, this may enable the forgery of TPM 2.0 attestations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.