Vulnerability · Published Aug 11, 2026 · Assigned by certcc
CVE-2026-6727CVE-2026-6727
Medium 5.9
In plain English
A medium-severity security flaw in TPM2.0 from Trusted Computing Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).
Official description
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libtpms | no fix listed | DEBIAN-CVE-2026-6727 |
| Debian:13 | libtpms | no fix listed | DEBIAN-CVE-2026-6727 |
| Debian:14 | libtpms | no fix listed | DEBIAN-CVE-2026-6727 |
| Ubuntu:22.04:LTS | libtpms | no fix listed | UBUNTU-CVE-2026-6727 |
| Ubuntu:24.04:LTS | libtpms | no fix listed | UBUNTU-CVE-2026-6727 |
| Ubuntu:26.04:LTS | libtpms | no fix listed | UBUNTU-CVE-2026-6727 |
| Ubuntu:26.10 | libtpms | no fix listed | UBUNTU-CVE-2026-6727 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Trusted Computing Group | TPM2.0 | 0 – through v184 |
Weakness: CWE-208 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N