{"id":"AZL-96876","summary":"CVE-2026-75900 affecting package swtpm 0.8.1-5","details":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.","modified":"2026-08-30T05:26:50Z","published":"2026-08-19T08:17:14Z","upstream":["CVE-2026-75900"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75900"}],"affected":[{"package":{"name":"swtpm","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/swtpm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.8.1-5"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96876.json"}}],"schema_version":"1.9.0"}