PT-2025-16386 · Unknown+1 · Tpm2 Reference Library+1

Published 2025-04-15 · Updated 2025-10-06 · CVE-2025-1292

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google ChromeOS version 122.0.6261.132

Description The issue is related to an Out-Of-Bounds Write in the TPM2 Reference Library, allowing an attacker with root access to gain persistence and bypass operating system verification. This is achieved by exploiting the NV Read functionality during the Challenge-Response process.

Recommendations For Google ChromeOS version 122.0.6261.132, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2025-05689

CVE-2025-1292

Affected Products

Google Chrome

Tpm2 Reference Library

References · 9

• 🔥 https://issuetracker.google.com/issues/324336238 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1292 · Security Note
• https://bdu.fstec.ru/vul/2025-05689 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1292 · Vendor Advisory
• https://issues.chromium.org/issues/b/324336238 · Note
• https://t.me/cveNotify/137528 · Telegram Post
• https://twitter.com/CVETracker/status/1912597046004982237 · Twitter Post
• https://t.me/cvedetector/23013 · Telegram Post
• https://twitter.com/CVEnew/status/1912238694410449317 · Twitter Post