CVE-2025-2884 is an out-of-bounds read vulnerability (CWE-125) in the Trusted Computing Group's TPM 2.0 implementation, specifically affecting virtual TPMs used in Shielded VMs. An authenticated local attacker with access to the vTPM interface can send crafted commands that exploit a mismatch in memory handling, causing out-of-bounds reads of vTPM memory. This can lead to disclosure of sensitive vTPM data and impact vTPM availability. The vulnerability is rated with a CVSS 3.1 score of 6.6 (medium severity), requiring local access with low complexity and user interaction. Some configurations may allow broader vTPM access beyond privileged users, increasing risk. Vendor guidance indicates no immediate customer action is needed as updates will be applied proactively during maintenance windows.

An authenticated local attacker with access to the vTPM interface can read sensitive memory beyond intended bounds, potentially exposing confidential vTPM data. Additionally, the vulnerability can impact the availability of the vTPM, which is critical for Shielded VM security. The attack requires local privileges and user interaction, limiting remote exploitation. The impact includes confidentiality loss and availability disruption but no integrity impact is indicated.

No customer action is required as the vendor (Google) will proactively update affected systems during standard maintenance windows. To reduce risk, it is recommended to restrict vTPM access to administrative (root) users, limiting the potential attacker base. Monitor vendor advisories for any future updates or patches. Patch status is not explicitly confirmed; check vendor advisories for current remediation guidance.