CVE-2025-59320 describes a vulnerability in CPSD CryptoPro Secure Disk for Bitlocker prior to version 7.7.4 where TPM 2.0 secrets are stored insecurely in unused disk sectors in a serialized format. An attacker with physical access to the system disk can extract these secrets and create an environment to unseal the TPM, potentially bypassing security protections tied to the TPM. The vulnerability is published but lacks a CVSS score and no official remediation or patch details have been provided.

The vulnerability allows an unauthenticated attacker with physical access to the affected system's disk to recover TPM 2.0 secrets. This could enable the attacker to unseal the TPM, undermining the security guarantees provided by the TPM such as disk encryption key protection. The impact is significant in scenarios where physical access is possible, potentially leading to unauthorized data access or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to affected systems to mitigate risk.