A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, which bypasses a subsequent bounds check due to an unsafe signed-to-unsigned conversion, causing the parser to read memory outside the bounds of the heap buffer holding the state data. Successful exploitation can crash the process hosting libtpms (such as swtpm), resulting in a denial of service of the emulated TPM device and the virtual machine that depends on it. No data corruption or information disclosure was confirmed.

libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of libtpms with OpenSSL 3.x contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality. Version 0.10.2 fixes the issue. No known workarounds are available.

libtpms implements the software TPM 2.0 engine used by swtpm/QEMU. Its NV/volatile state (de)serializer in src/tpm2/NVMarshal.c uses blockskipread() (src/tpm2/NVMarshal.c:158-188) to skip an optional versioned sub-block when the running code does not need it. The function reads an attacker-controlled 16-bit blocksize field from the stream and then does 'buffer += blocksize; size -= blocksize;' with NO check that blocksize <= size. Because size is a signed INT32, a forged blocksize larger than the remaining bytes drives size negative. Every scalar unmarshal primitive in src/tpm2/Unmarshal.c (UINT8/16/32/64Unmarshal, ArrayUnmarshal) guards its bounds check as '(UINT32)size < sizeof(...)', which implicitly casts the now-negative size to UINT32, wrapping it to a huge unsigned value that passes the check. The next field read then dereferences buffer past the end of the heap allocation backing the state blob (CWE-125).

Reachable from TPMLIBSetState(TPMLIBSTATEVOLATILE/PERMANENT, ...) via VolatileStateUnmarshal()/PERSISTENTALLUnmarshal(), i.e. the power-on/restore and state-import paths. blockskipread() only performs pointer arithmetic and never copies skipped bytes, so the realistic impact is denial of service (process crash / TPM failure mode), not information disclosure.

Reported by Isuka Sanuj (CyberCrew Inc.) on 2026-09-01; independently reported publicly by Leyao (ICT CAS) as github.com/stefanberger/libtpms/issues/614 on 2026-09-04. PSIRTSUPT-23184.

Affected: all released libtpms versions carrying TPM 2.0 state deserialization code, including v0.10.2 (commit 03ff2481e133540be3b3ffe3daa1483d2a73d967). Upstream fix on master in commit b1462888180d896af03cae0487e8d45009cc445e ('tpm2: Add checks for size < 0 before casting it to UINT32'), adding 'size < 0 ||' guards to UINT8/16/32/64Unmarshal and ArrayUnmarshal. Not yet present in any tagged release as of 2026-09-04.