A flaw in libtpms allows an attacker to supply a malformed TPM 2.0 state blob that contains an oversized skip-block length. This length is not validated against the remaining input, driving an internal size counter negative and, because of an unsafe signed‑to‑unsigned conversion, bypassing the subsequent bounds check. The result is a heap out‑of‑bounds read that can crash the process hosting libtpms—such as swtpm—causing a denial of service for the emulated TPM device and any virtual machine that depends on it. No data corruption or information disclosure was confirmed.

The vulnerability exists in Red Hat Enterprise Linux 10, 8 and 9, where libtpms provides software TPM 2.0 emulation. Systems running these RHEL releases that use libtpms for virtual machine TPM support are affected and may experience service interruption when powering on or restoring a virtual machine from a state that includes a malicious blob.

The CVSS score of 6.5 indicates a moderate severity impact. The EPSS score is not available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is during a TPM state restoration—such as a virtual machine power‑on, migration, or state load—driving the out‑of‑bounds read; in practice this could be invoked locally if an attacker can influence the state blob or remotely if the attacker can force a state restore through an untrusted input channel. Successful exploitation results only in denial of service, not in disclosure of data or corruption of the emulator memory.