CVE-2026-6923
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A side-channel attack requiring physical presence at the TPM can lead to extraction of an Elliptic Curve Diffie-Hellman (ECDH) key. The vulnerability affects protection of cryptographic keys stored in the TPM.
Risk Assessment
An actor with physical access to the device may extract the ECDH key, potentially compromising the confidentiality of communications and data protected by that key. The risk is significant for devices physically accessible to unauthorized persons.
Recommendation
Restrict physical access to devices with TPM modules and enforce physical access controls. Monitor the TPM vendor for fixes and consider rotating ECDH keys if compromise is suspected.
Other vulnerabilities in TPM
See all- CVE-2026-6727Medium
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker may exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the Endorsement Key (EK). Under certain conditions, this may also enable forgery of TPM 2.0 attestations.
- CVE-2026-6726High
An information leakage vulnerability in the TCG TPM 2.0 reference code could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key and falsify other TPM 2.0 attestations with this key.
Original NVD description (English source)
A side-channel attack, which requires a physical presence to the TPM, can lead to extraction of an Elliptic Curve Diffie-Hellman (ECDH) key.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS