An out-of-bounds read was discovered in swtpm's SWTPM_NVRAM_CheckHeader() function where the buffer length is incorrectly validated against the size of a pointer instead of the structure. This mismatch allows a buffer smaller than the required size to pass verification, resulting in a 2-byte heap overread on 64-bit systems (or 6 bytes on 32-bit). The read can expose heap data in logs and may terminate the swtpm daemon on some platforms, causing service disruption. The flaw maps to CWE-125 – Out-of-Bounds Read.

Red Hat Enterprise Linux 8, 9, and 10 are affected because their default swtpm packages ship versions earlier than 0.10.2. Any system running the swtpm emulator in these RHEL releases without the patch is vulnerable. No other vendors or versions are listed for this issue.

The CVSS base score is 6.1, indicating a moderate severity. The EPSS score is reported as less than 1 %, suggesting a very low exploitation probability at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector involves local interaction with the swtpm daemon, possibly requiring elevated privileges to supply the undersized buffer. Attackers would need to influence the swtpm daemon’s input to trigger the overread, making local or privileged access the most relevant attack scenarios.