Security readout for executives and security teams
Plain-English summary
A flaw in the TPM 2.0 reference code can read memory outside its intended boundary when incompatible signing settings are processed. Successful triggering could expose sensitive memory or disrupt service. The issue requires local access, limited privileges, and user interaction according to the CVSS assessment, reducing the likelihood of broad remote attacks.
Executive priority
Schedule near-term, risk-based remediation for confirmed affected implementations. Expedite systems shared with untrusted local users or workloads because the scored consequences include memory disclosure and service disruption. This is not supported as an internet-wide emergency, but uncertainty in downstream product coverage warrants prompt supplier confirmation and asset review.
Technical view
CryptHmacSign does not validate that the requested signature scheme matches the signing key algorithm, causing a CWE-125 out-of-bounds read. CVSS 3.1 scores it 6.6 with high confidentiality and availability impact, no scored integrity impact, and local attack requirements. TCG documents the correction in TCGVRT0009 and Errata Revision 1.83.
Likely exposure
Exposure primarily concerns products incorporating the vulnerable TCG reference implementation or affected downstream code, including potentially impacted software TPM implementations. Generic TPM 2.0 presence does not establish vulnerability. The bundle does not provide a comprehensive affected-version or product list, so organizations need confirmation from their hardware, firmware, operating-system, virtualization, and TPM software suppliers.
Exploitation context
The supplied CVSS vector requires local access, low privileges, and user interaction. CISA KEV status is false, and the source bundle provides no evidence of active exploitation or public weaponization. Practical exploitability may vary substantially between downstream implementations and their exposure of the affected signing operation.
Researcher notes
The vulnerable condition is an algorithm-consistency validation failure before HMAC signing, resulting in an out-of-bounds read rather than a scored write primitive. Downstream behavior and reachable impact require implementation-specific analysis. CVE-2025-49133 is identified only as related; the supplied evidence does not establish that it is interchangeable with CVE-2025-2884.
Mitigation direction
- Apply supplier updates incorporating TCG Errata Revision 1.83 and advisory TCGVRT0009.
- For libtpms deployments, assess and apply the linked patch through normal vendor maintenance.
- Check Intel, Siemens, and other relevant supplier advisories for product-specific remediation.
- Where updates are unavailable, consult the supplier and restrict untrusted local access to affected systems.
Validation and detection
- Inventory TPM firmware, software TPMs, emulators, and libraries derived from the TCG reference implementation.
- Map identified component versions against TCGVRT0009, Errata 1.83, and applicable supplier advisories.
- Confirm whether deployed libtpms code includes the linked corrective change.
- Verify installed firmware and package versions after remediation using supplier-supported inventory methods.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-2884 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H1.35.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.6MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://trustedcomputinggroup.org/about/security/CVE reference, certcc
- TPM2.0 ErrataCVE reference, certcc
- Vendor AdvisoryCVE reference, certcc
- Vendor PatchCVE reference, certcc
- Related CVECVE reference, certcc
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01209.htmlCVE reference, CVE
- https://www.kb.cert.org/vuls/id/282450CVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-628843.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.