CVE-2025-1292

CVE-2025-1292 describes an Out-Of-Bounds Write vulnerability in the TPM2 Reference Library affecting Google ChromeOS 122.0.6261.132 stable on Cr50 Boards. This flaw allows an attacker with root access to achieve persistence and bypass OS verification by exploiting the NV_Read function during the Challenge-Response process. Rated 6.7 MEDIUM, the vulnerability requires high privileges (PR:H) but has low attack complexity (AC:L), enabling high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.