CVE catalog
CVE-2025-49133
libtpms vulnerability
- Severity
- Medium · CVSS 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.17% · Oct 25, 2026
Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the "Part 4: Supporting Routines – Code" document, section "7.151 - /tpm/src/crypt/CryptUtil.c ". This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libtpms | sid | 0.10.2-5 | fixed |
| Debian | libtpms | forky | 0.10.2-5 | fixed |
| Debian | libtpms | trixie | 0.9.2-3.2 | fixed |
| Debian | libtpms | bookworm | 0.9.2-3.1+deb12u1 | fixed |
| Debian | libtpms | bookworm-security | 0.9.2-3.1~deb12u1 | vulnerable |
| Ubuntu | libtpms | noble | 0.9.2-3.1+deb12u1 | fixed |
| Ubuntu | libtpms | noble | 0.9.3-0ubuntu4.24.04.1 | fixed |
| Ubuntu | libtpms-dev | noble | 0.9.3-0ubuntu4.24.04.1 | fixed |
| Ubuntu | libtpms0 | noble | 0.9.3-0ubuntu4.24.04.1 | fixed |
| Suse | libtpms | linux enterprise micro 5.3 | 0.8.2-150300.3.12.1 | fixed |
| Suse | libtpms | linux enterprise micro 5.4 | 0.8.2-150300.3.12.1 | fixed |
| Suse | libtpms | linux enterprise micro 5.5 | 0.8.2-150300.3.12.1 | fixed |
| Ubuntu | libtpms | 22.04 | 0.8.2-1ubuntu1 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.0-0ubuntu1 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.0-0ubuntu2 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.0-0ubuntu3 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.0-0ubuntu4 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.3-0ubuntu1 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.3-0ubuntu1.22.04.1 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.3-0ubuntu1.22.04.2 | fixed |
| Ubuntu | libtpms | 24.04 | 0.9.3-0ubuntu2 | vulnerable |
| Ubuntu | libtpms | 24.04 | 0.9.3-0ubuntu3 | vulnerable |
| Ubuntu | libtpms | 24.04 | 0.9.3-0ubuntu4 | vulnerable |
| Ubuntu | libtpms | 24.04 | 0.9.3-0ubuntu4.24.04.1 | fixed |
| Ubuntu | libtpms | 22.04 | 0.8.2-1ubuntu1 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.0-0ubuntu1 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.0-0ubuntu2 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.0-0ubuntu3 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.0-0ubuntu4 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.3-0ubuntu1 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.3-0ubuntu1.22.04.1 | vulnerable |
| Ubuntu | libtpms | 22.04 | 0.9.3-0ubuntu1.22.04.2 | fixed |
| Ubuntu | libtpms | 24.04 | 0.9.3-0ubuntu2 | vulnerable |
| Ubuntu | libtpms | 24.04 | 0.9.3-0ubuntu3 | vulnerable |
| Ubuntu | libtpms | 24.04 | 0.9.3-0ubuntu4 | vulnerable |
| Ubuntu | libtpms | 24.04 | 0.9.3-0ubuntu4.24.04.1 | fixed |
| Suse | libtpms | linux enterprise module for server applications 15 sp7 | 0.9.6-150600.3.3.1 | fixed |
| Opensuse | libtpms | leap 15.6 | 0.9.6-150600.3.3.1 | fixed |
| Suse | libtpms | linux micro 6.0 | 0.9.6-2.1 | fixed |
| Suse | libtpms | linux micro 6.1 | 0.9.6-slfo.1.1_2.1 | fixed |
| Opensuse | libtpms | tumbleweed | 0.10.1-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libtpms | source | sid | 0.9.2-3.2 | not yet assigned | Not reported | [1107617] |
| Debian | libtpms | source | forky | 0.9.2-3.2 | not yet assigned | Not reported | [1107617] |
| Debian | libtpms | source | trixie | 0.9.2-3.2 | not yet assigned | Not reported | [1107617] |
| Debian | libtpms | source | bookworm | 0.9.2-3.1+deb12u1 | not yet assigned | Not reported | [1107617] |
| Ubuntu | libtpms | deb | noble | 0.9.2-3.1+deb12u1 | Not reported | Not reported | Not reported |
| Ubuntu | libtpms | deb | noble | 0.9.3-0ubuntu4.24.04.1 | Not reported | Not reported | Not reported |
| Ubuntu | libtpms-dev | deb | noble | 0.9.3-0ubuntu4.24.04.1 | Not reported | Not reported | Not reported |
| Ubuntu | libtpms0 | deb | noble | 0.9.3-0ubuntu4.24.04.1 | Not reported | Not reported | Not reported |
| Suse | libtpms | rpm | linux enterprise micro 5.3 | 0.8.2-150300.3.12.1 | Not reported | SUSE-SU-2026:4278-1 | Not reported |
| Suse | libtpms | rpm | linux enterprise micro 5.4 | 0.8.2-150300.3.12.1 | Not reported | SUSE-SU-2026:4278-1 | Not reported |
| Suse | libtpms | rpm | linux enterprise micro 5.5 | 0.8.2-150300.3.12.1 | Not reported | SUSE-SU-2026:4278-1 | Not reported |
| Ubuntu | libtpms | deb | 22.04 | 0.9.3-0ubuntu1.22.04.2 | Not reported | UBUNTU-CVE-2025-49133 | Not reported |
| Ubuntu | libtpms | deb | 24.04 | 0.9.3-0ubuntu4.24.04.1 | Not reported | UBUNTU-CVE-2025-49133 | Not reported |
| Ubuntu | libtpms | deb | 22.04 | 0.9.3-0ubuntu1.22.04.2 | Not reported | USN-7617-1 | Not reported |
| Ubuntu | libtpms | deb | 24.04 | 0.9.3-0ubuntu4.24.04.1 | Not reported | USN-7617-1 | Not reported |
| Suse | libtpms | rpm | linux enterprise module for server applications 15 sp7 | 0.9.6-150600.3.3.1 | Not reported | SUSE-SU-2026:1388-1 | Not reported |
| Opensuse | libtpms | rpm | leap 15.6 | 0.9.6-150600.3.3.1 | Not reported | SUSE-SU-2026:1388-1 | Not reported |
| Suse | libtpms | rpm | linux micro 6.0 | 0.9.6-2.1 | Not reported | SUSE-SU-2026:21064-1 | Not reported |
| Suse | libtpms | rpm | linux micro 6.1 | 0.9.6-slfo.1.1_2.1 | Not reported | SUSE-SU-2026:21035-1 | Not reported |
| Opensuse | libtpms | rpm | tumbleweed | 0.10.1-1.1 | Not reported | OPENSUSE-SU-2025:15244-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libtpms0]Affected
Source package: [libtpms]
Details (4)
0.9.2-3.1+deb12u1· amd64 · bookwormFixed · Fixed:
0.9.2-3.1+deb12u1usn · libtpms · debian · bookworm; usn · libtpms · debian · 12
0.9.2-3.1+deb12u1· arm64 · bookwormFixed · Fixed:
0.9.2-3.1+deb12u1usn · libtpms · debian · bookworm; usn · libtpms · debian · 12
0.9.2-3.1~deb12u1· amd64 · bookworm-securityAffected · Fixed:
0.9.2-3.1+deb12u1usn · libtpms · debian · bookworm; usn · libtpms · debian · 12
0.9.2-3.1~deb12u1· arm64 · bookworm-securityAffected · Fixed:
0.9.2-3.1+deb12u1usn · libtpms · debian · bookworm; usn · libtpms · debian · 12
- [libtpms-dev]Affected
Source package: [libtpms]
Details (4)
0.9.2-3.1+deb12u1· amd64 · bookwormFixed · Fixed:
0.9.2-3.1+deb12u1usn · libtpms · debian · bookworm; usn · libtpms · debian · 12
0.9.2-3.1+deb12u1· arm64 · bookwormFixed · Fixed:
0.9.2-3.1+deb12u1usn · libtpms · debian · bookworm; usn · libtpms · debian · 12
0.9.2-3.1~deb12u1· amd64 · bookworm-securityAffected · Fixed:
0.9.2-3.1+deb12u1usn · libtpms · debian · bookworm; usn · libtpms · debian · 12
0.9.2-3.1~deb12u1· arm64 · bookworm-securityAffected · Fixed:
0.9.2-3.1+deb12u1usn · libtpms · debian · bookworm; usn · libtpms · debian · 12
[openSUSE Tumbleweed]
- [libtpms0]Unknown
Source package: [libtpms]
Details (1)
0.10.2-1.4· x86_64 · tumbleweedUnknown · Fixed:
0.10.1-1.1Version impact unknown
usn · libtpms · opensuse · tumbleweed
- [libtpms-devel]Unknown
Source package: [libtpms]
Details (1)
0.10.2-1.4· x86_64 · tumbleweedUnknown · Fixed:
0.10.1-1.1Version impact unknown
usn · libtpms · opensuse · tumbleweed
[Debian 13 (Trixie)]
- [libtpms0]Fixed
Source package: [libtpms]
Details (2)
0.9.2-3.2· amd64 · trixieFixed · Fixed:
0.9.2-3.2usn · libtpms · debian · 13
0.9.2-3.2· arm64 · trixieFixed · Fixed:
0.9.2-3.2usn · libtpms · debian · 13
- [libtpms-dev]Fixed
Source package: [libtpms]
Details (2)
0.9.2-3.2· amd64 · trixieFixed · Fixed:
0.9.2-3.2usn · libtpms · debian · 13
0.9.2-3.2· arm64 · trixieFixed · Fixed:
0.9.2-3.2usn · libtpms · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/essa-2025_3052.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-49133]
- [https://osv.dev/vulnerability/SUSE-SU-2026:1388-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:21035-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:21064-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4278-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-49133]
- [https://osv.dev/vulnerability/USN-7617-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15244-1]
- [https://security-tracker.debian.org/tracker/CVE-2025-49133]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-49133.json]
- [https://ubuntu.com/security/notices/USN-7617-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1669.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]