The vulnerability in libtpms causes the library to return the initial initialization vector instead of the updated one when certain symmetric ciphers are used, thereby weakening the cryptographic strength of subsequent encryption and decryption operations. This flaw is a cryptographic weakness that undermines data confidentiality, making encrypted data more susceptible to decryption by an attacker. It is rooted in the improper handling of IVs and the use of a weak cryptographic algorithm, as indicated by the associated CWE identifiers.

Affected versions are libtpms 0.10.0 and 0.10.1. The library is provided by stefanberger under the libtpms project and is commonly integrated with OpenSSL 3.x. Version 0.10.2 and later contain a fix that restores correct IV handling. No other product versions are listed as affected.

The CVSS vector indicates a medium severity (5.5). The EPSS score is below 1%, implying a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to operate in an environment where libtpms is used for encryption, and success would primarily compromise data confidentiality rather than achieving remote code execution or denial of service.