CVE-2026-6727

{
  "id": "CVE-2026-6727",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T16:17:34.503",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de canal lateral de tiempo en la implementación de descifrado RSA OAEP. Un atacante local privilegiado con acceso a la interfaz de comandos del TPM podría ser capaz de explotar diferencias de tiempo para recuperar información que podría permitir el descifrado de cifrados cifrados con claves RSA gestionadas por el TPM, incluyendo la clave de respaldo RSA (EK), incluyendo blobs de importación, blobs de credenciales y sales de sesión. Bajo ciertas condiciones, esto también podría permitir la falsificación de atestaciones de TPM 2.0. Consulte TCGVRT0011."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Trusted Computing Group",
          "product": "TPM2.0",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "v184",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.4,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T18:41:21.277166Z",
          "id": "CVE-2026-6727",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-208"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://trustedcomputinggroup.org/about/security/",
      "source": "[email protected]"
    },
    {
      "url": "https://trustedcomputinggroup.org/wp-content/uploads/Extended-vrt0010-11-guidance_V1.pdf",
      "source": "[email protected]"
    },
    {
      "url": "https://trustedcomputinggroup.org/wp-content/uploads/VRT0011-Advisory_Final-1.pdf",
      "source": "[email protected]"
    }
  ]
}