Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the "Part 4: Supporting Routines – Code" document, section "7.151 - /tpm/src/crypt/CryptUtil.c ". This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into     Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted     Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs     in the CryptHmacSign' function with an inconsistent pairing of the signKey and signScheme parameters,     where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is     in the CryptHmacSign' function, which is defined in the Part 4: Supporting Routines  Code document,     section 7.151 - /tpm/src/crypt/CryptUtil.c . This vulnerability can be triggered from user-mode     applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an     affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the     detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This     vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1. (CVE-2025-49133)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-12527 advisory.

    - Fixes: CVE-2022-40284
    - Fix CVE-2024-7383 NBD server improper certificate validation       resolves: RHEL-52728

    libtpms     libvirt

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12527 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:12100 advisory.

    * libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12293 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-12100 advisory.

    [0.9.1-5.20211126git1ff6fe1f43]
    - Fix CVE-2025-49133       Resolves: RHEL-96258

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12234 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:12100 advisory.

    The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.

    Security Fix(es):

    * libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:12112 advisory.

    The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.

    Security Fix(es):

    * libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:12111 advisory.

    The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.

    Security Fix(es):

    * libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7617-1 advisory.

    It was discovered that libtpms did not properly manage memory when performing crafted cryptographic     operations. An attacker could possibly use this issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-77cdabc09b advisory.

    Upgrade to libtpms 0.10.1 fixing CVE-2025-49133

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-25aa48d158 advisory.

    Upgrade to libtpms 0.9.7 fixing CVE-2025-49133

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
244744	Linux Distros Unpatched Vulnerability : CVE-2025-49133	Nessus	Misc.	medium
243582	Oracle Linux 8 : virt:rhel / and / virt-devel:rhel (ELSA-2025-12527)	Nessus	Oracle Linux Local Security Checks	medium
243453	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2025:12527)	Nessus	Red Hat Local Security Checks	medium
243056	AlmaLinux 9 : libtpms (ALSA-2025:12100)	Nessus	Alma Linux Local Security Checks	medium
243052	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2025:12293)	Nessus	Red Hat Local Security Checks	medium
243041	Oracle Linux 9 : libtpms (ELSA-2025-12100)	Nessus	Oracle Linux Local Security Checks	medium
243012	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2025:12234)	Nessus	Red Hat Local Security Checks	medium
242994	RHEL 9 : libtpms (RHSA-2025:12100)	Nessus	Red Hat Local Security Checks	medium
242989	RHEL 9 : libtpms (RHSA-2025:12112)	Nessus	Red Hat Local Security Checks	medium
242988	RHEL 9 : libtpms (RHSA-2025:12111)	Nessus	Red Hat Local Security Checks	medium
241422	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : libtpms vulnerability (USN-7617-1)	Nessus	Ubuntu Local Security Checks	medium
240560	Fedora 42 : libtpms (2025-77cdabc09b)	Nessus	Fedora Local Security Checks	medium
240527	Fedora 41 : libtpms (2025-25aa48d158)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2025-49133

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium