The Trusted Computing Group TPM2.0 reference implementation contains an out-of-bounds read vulnerability (CWE-125) in the CryptHmacSign helper function. This flaw arises because the function does not validate that the signature scheme matches the signature key's algorithm, potentially allowing unauthorized memory reads. The vulnerability is documented in Errata Revision 1.83 and advisory TCGVRT0009 for the TPM2.0 standard. It has a CVSS 3.1 base score of 6.6, with attack vector local, low attack complexity, low privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation of this vulnerability could result in unauthorized disclosure of sensitive information due to out-of-bounds memory reads, impacting confidentiality. Additionally, it may cause denial of service conditions affecting availability. There is no indication of integrity impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the Trusted Computing Group's official advisory TCGVRT0009 and Errata Revision 1.83 for current remediation guidance. Until an official fix is available, limit access to affected TPM2.0 implementations and monitor for updates from the vendor.