Out-of-Bounds Read Vulnerability in libtpms - Security Update Required
Summary
ALSA-2025:16428: Moderate: libtpms security update. Affects libtpms versions < 0.9.6-11.el10_0. Fixed in 0.9.6-11.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtpms is a library that provides Trusted Platform Module (TPM) functionality for virtual machines. It enables secure cryptographic operations and helps in managing keys and certificates, ensuring the integrity of the virtual environment. However, recent findings have revealed a security flaw that could potentially expose sensitive data.
Vulnerability Detail
The vulnerability identified as CVE-2025-49133 is an Out-of-Bounds Read issue in libtpms. This flaw arises from improper handling of memory, which can lead to unauthorized access to sensitive information. Attackers exploiting this vulnerability could read memory locations beyond the intended buffer, potentially exposing confidential data or leading to further attacks on the system.
How To Fix
Minimum fixed version
0.9.6-11.el10_0
This is the first release that contains the fix.
sudo dnf update libtpmsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available security update as soon as possible.
Conclusion
The libtpms library has a critical vulnerability that requires immediate attention. By updating to the latest patched version, users can protect their systems from potential exploits. It is advisable to monitor for vulnerabilities regularly using tools like Vulert to ensure ongoing security.
See every vulnerability recorded for libtpms →
FAQ
CVE-2025-49133 is a security vulnerability in the libtpms library that allows for Out-of-Bounds Read, potentially exposing sensitive data.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Failing to address this vulnerability could lead to unauthorized access to sensitive information, which may compromise the security of your virtual machines and overall system integrity.
Yes, a patch is available. Updating to version 0.9.6-11.el10_0 or later of the libtpms package will resolve the issue.
While there are no specific workarounds, it is crucial to prioritize the update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libtpms.
