PT-2026-1122 · Libtpms+1 · Libtpms+1

Stefanberger · Published 2026-01-02 · Updated 2026-03-25 · CVE-2026-21444

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions libtpms versions 0.10.0 through 0.10.1

Description libtpms, a library providing software emulation of a Trusted Platform Module, contains a flaw impacting data confidentiality. When integrated with OpenSSL 3.x, the library incorrectly returns the initial Initialization Vector (IV) instead of the last IV during symmetric cipher operations. This weakens encryption and decryption processes.

Recommendations Update to version 0.10.2 or later.

Exploit

Fix

Use of Insufficiently Random Values

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-330

CWE-327

Related Identifiers

BDU:2026-00914

CVE-2026-21444

GHSA-7JXR-4J3G-P34F

OPENSUSE-SU-2026:10422-1

OPENSUSE-SU-2026:20695-1

SUSE-SU-2026:21571-1

SUSE-SU-2026:21581-1

Affected Products

Openssl

Libtpms

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21444.json · Exploit
• 🔥 https://github.com/stefanberger/libtpms/issues/541 · Exploit
• https://github.com/stefanberger/libtpms/security/advisories/GHSA-7jxr-4j3g-p34f · Vendor Advisory
• https://github.com/stefanberger/libtpms/commit/33c9ff074cb16c1841ce7d7f33643c17c426743a · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-21444 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21444 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00914 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10422-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-21444 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21444 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21444 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21444 · Security Note
• https://t.me/cveNotify/147593 · Telegram Post
• https://altsp.su/obnovleniya-bezopasnosti · Note