CVE-2026-75900

Name of the Vulnerable Software and Affected Versions swtpm (affected versions not specified)

Description An out-of-bounds read exists in the SWTPM NVRAM CheckHeader() function. The issue occurs because the entry guard validates the buffer length using sizeof(bh), which refers to the size of a pointer, rather than sizeof(*bh), which refers to the actual structure size. This mismatch allows undersized buffers to pass validation, resulting in a heap overread when accessing the totlen field. On 64-bit systems, this causes a 2-byte overread, while 32-bit systems experience a 6-byte overread. This can lead to daemon termination on certain platforms and the leakage of heap data into the logs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.