CVE-2026-75900 Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch
An out-of-bounds read in swtpm allows attackers to cause daemon termination and leak heap data via undersized buffers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75900?
CVE-2026-75900 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 19 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.
Weakness: CWE-125
Which versions are affected by CVE-2026-75900?
Linux distribution packages (8)
swtpm SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 0.9.0-150700.3.3.1 |
swtpm SUSE:Linux Enterprise Server 16.0 | All versions | 0.10.2-160000.1.1 |
swtpm SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 0.10.2-160000.1.1 |
swtpm SUSE:Linux Micro 6.0 | All versions | 0.8.0-2.1 |
swtpm SUSE:Linux Micro 6.1 | All versions | 0.9.0-slfo.1.1_3.1 |
swtpm SUSE:Linux Micro 6.2 | All versions | 0.10.2-160000.1.1 |
swtpm openSUSE:Leap 16.0 | All versions | 0.10.2-160000.1.1 |
swtpm openSUSE:Tumbleweed | All versions | 0.10.2-1.1 |
How do I fix CVE-2026-75900?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-75900 being exploited?
There is no known exploitation of CVE-2026-75900 in the wild and no public exploit code.
Sources
Also known as AZL-96876, DEBIAN-CVE-2026-75900, GHSA-gqrg-h59c-j4wj, SUSE-SU-2026:23879-1, SUSE-SU-2026:23927-1, SUSE-SU-2026:24114-1 and 5 more.