Vulnerability · Published Aug 19, 2026 · Assigned by redhat
CVE-2026-75900Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch
Medium 6.1
In plain English
A medium-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | swtpm | 0.10.2 | ALPINE-CVE-2026-75900 |
| Alpine:v3.22 | swtpm | 0.10.2 | ALPINE-CVE-2026-75900 |
| Alpine:v3.23 | swtpm | 0.10.2 | ALPINE-CVE-2026-75900 |
| Alpine:v3.24 | swtpm | 0.10.2 | ALPINE-CVE-2026-75900 |
| Debian:12 | swtpm | no fix listed | DEBIAN-CVE-2026-75900 |
| Debian:13 | swtpm | no fix listed | DEBIAN-CVE-2026-75900 |
| Debian:14 | swtpm | 0.10.2-1 | DEBIAN-CVE-2026-75900 |
| Ubuntu:22.04:LTS | swtpm | no fix listed | UBUNTU-CVE-2026-75900 |
| Ubuntu:24.04:LTS | swtpm | no fix listed | UBUNTU-CVE-2026-75900 |
| Ubuntu:26.04:LTS | swtpm | no fix listed | UBUNTU-CVE-2026-75900 |
| Ubuntu:26.10 | swtpm | no fix listed | UBUNTU-CVE-2026-75900 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-75900 vdb-entry, x_refsource_REDHAT
- RHBZ#2517910 issue-tracking, x_refsource_REDHAT