The tracked vulnerability is an out‑of‑bounds read located in the CryptHmacSign helper function of the TCG TPM2.0 reference implementation. The issue arises because the function does not verify that the supplied signature scheme matches the algorithm used by the signature key, allowing an attacker to read memory contents beyond the bounds of a buffer. This read can potentially expose sensitive data stored in memory, thus compromising confidentiality. The weakness is identified as CWE‑125.

The affected vendor is the Trusted Computing Group, providing the TPM2.0 reference implementation library. Any system that uses this reference implementation, particularly the versions prior to the errata revision 1.83, is susceptible. Exact version details are not disclosed beyond the reference to the errata release, indicating that earlier builds lack the necessary bounds checks.

With a CVSS score of 6.6, the risk is considered moderate. The EPSS score of less than 1% suggests a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, reducing immediate urgency. The attack likely requires a privilege that allows crafting a malicious signature or manipulating input to the CryptHmacSign function, which may be achievable through an application that interfaces directly with the TPM. Further exploitation beyond information disclosure is not documented in the available data.