CVE-2026-75900: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10
CVE-2026-75900 is an out-of-bounds read vulnerability in the swtpm component of Red Hat Enterprise Linux 10. The flaw arises from improper buffer length validation in the SWTPM_NVRAM_CheckHeader() function, where the size of a pointer is checked instead of the size of the actual struct. This leads to a heap overread of 2 bytes on 64-bit systems and 6 bytes on 32-bit systems, potentially causing daemon crashes and leaking adjacent heap data to logs. Red Hat rates this issue as moderate impact with a CVSS score of 6.1. A fix is available in swtpm version 0.10.2. No mitigation other than upgrading is currently recommended.
AI Analysis
Technical Summary
The vulnerability in swtpm's SWTPM_NVRAM_CheckHeader() function is due to checking buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This incorrect check allows an undersized buffer to pass validation, causing a heap overread when accessing the totlen field. On 64-bit systems, this results in a 2-byte overread; on 32-bit systems, a 6-byte overread. The out-of-bounds read can cause the swtpm daemon to terminate on some platforms and leaks a small amount of adjacent heap data to the log. The issue is distinct from CVE-2022-23645, which addressed a different validation aspect. Red Hat has assigned a moderate severity rating and a CVSS v3.1 score of 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H). The vulnerability affects Red Hat Enterprise Linux 10 and is fixed in swtpm version 0.10.2.
Potential Impact
An attacker with local access to the control channel can send a specially crafted 8-byte state blob that bypasses buffer length validation, causing a heap overread. This can lead to daemon termination (denial of service) and leakage of adjacent heap memory data to logs, potentially exposing sensitive information. The confidentiality impact is low, integrity impact is none, and availability impact is high according to Red Hat's CVSS assessment.
Mitigation Recommendations
A fix is available in swtpm version 0.10.2. Red Hat recommends upgrading to this fixed version to remediate the vulnerability. No other mitigations meeting Red Hat's criteria for ease of use, applicability, or stability are currently available.
CVE-2026-75900: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10
Description
CVE-2026-75900 is an out-of-bounds read vulnerability in the swtpm component of Red Hat Enterprise Linux 10. The flaw arises from improper buffer length validation in the SWTPM_NVRAM_CheckHeader() function, where the size of a pointer is checked instead of the size of the actual struct. This leads to a heap overread of 2 bytes on 64-bit systems and 6 bytes on 32-bit systems, potentially causing daemon crashes and leaking adjacent heap data to logs. Red Hat rates this issue as moderate impact with a CVSS score of 6.1. A fix is available in swtpm version 0.10.2. No mitigation other than upgrading is currently recommended.
CVSS v3.1
Score 6.1medium
Affected software
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in swtpm's SWTPM_NVRAM_CheckHeader() function is due to checking buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This incorrect check allows an undersized buffer to pass validation, causing a heap overread when accessing the totlen field. On 64-bit systems, this results in a 2-byte overread; on 32-bit systems, a 6-byte overread. The out-of-bounds read can cause the swtpm daemon to terminate on some platforms and leaks a small amount of adjacent heap data to the log. The issue is distinct from CVE-2022-23645, which addressed a different validation aspect. Red Hat has assigned a moderate severity rating and a CVSS v3.1 score of 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H). The vulnerability affects Red Hat Enterprise Linux 10 and is fixed in swtpm version 0.10.2.
Potential Impact
An attacker with local access to the control channel can send a specially crafted 8-byte state blob that bypasses buffer length validation, causing a heap overread. This can lead to daemon termination (denial of service) and leakage of adjacent heap memory data to logs, potentially exposing sensitive information. The confidentiality impact is low, integrity impact is none, and availability impact is high according to Red Hat's CVSS assessment.
Mitigation Recommendations
A fix is available in swtpm version 0.10.2. Red Hat recommends upgrading to this fixed version to remediate the vulnerability. No other mitigations meeting Red Hat's criteria for ease of use, applicability, or stability are currently available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-08-18T14:30:48.257Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-75900","vendor":"Red Hat"}]
Threat ID: 6a8563b2c6e8be03326382b5
Added to database: 08/19/2026, 08:05:06 UTC
Last enriched: 09/11/2026, 09:33:46 UTC
Last updated: 10/02/2026, 02:46:06 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.