The Trusted Computing Group TPM2.0 reference implementation contains an out-of-bounds read vulnerability (CWE-125) in the CryptHmacSign helper function. This occurs because the function does not validate that the signature scheme matches the signature key's algorithm, potentially allowing memory to be read beyond intended boundaries. The vulnerability has a CVSS 3.1 base score of 6.6, indicating medium severity, with attack vector local, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality and availability. The vulnerability is documented in Errata Revision 1.83 and advisory TCGVRT0009. No known exploits are reported in the wild, and no patch or remediation details are currently available from the vendor or CERT advisory.

Successful exploitation could lead to unauthorized disclosure of sensitive information (high confidentiality impact) and disruption of service (high availability impact). The attack requires local access with low privileges and user interaction, limiting remote exploitation. Integrity is not impacted. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://www.kb.cert.org/vuls/id/282450 for current remediation guidance. Until an official fix is available, limit local access to trusted users and monitor for unusual activity related to TPM operations. Avoid relying on untrusted applications invoking TPM CryptHmacSign functionality.