An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4366-1 advisory.

    This update for swtpm fixes the following issue:

    - CVE-2026-75900: out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct)     mismatch       (bsc#1275653).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0967 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-75900:
    An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry     guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the     actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on     64-bit systems (6 bytes on 32-bit) when accessing the totlen field.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry
    guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the
    actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on
    64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on
    some platforms and leaks heap data to the log. (CVE-2026-75900)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry     guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the     actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on     64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on     some platforms and leaks heap data to the log. (CVE-2026-75900)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
351411	SUSE SLES15 Security Update : swtpm (SUSE-SU-2026:4366-1)	Nessus	SuSE Local Security Checks	Local	medium
343515	TencentOS Server 4: swtpm (TSSA-2026:0967)	Nessus	Tencent Local Security Checks	Local	medium
446107	Alpine: multiple swtpm packages: security update to 0.10.2	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
446107	Alpine: multiple swtpm packages: security update to 0.10.2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
338042	Linux Distros Unpatched Vulnerability : CVE-2026-75900	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-75900

medium

Tenable Plugins

medium

medium

medium

medium

medium