CVE-2026-21444

CVE-2026-21444 is a medium-severity vulnerability affecting libtpms versions 0.10.0 and 0.10.1, a software emulation library for Trusted Platform Modules. The flaw, specifically when integrated with OpenSSL 3.x, causes the library to incorrectly return the initial initialization vector (IV) instead of the last IV for certain symmetric ciphers, weakening subsequent encryption and decryption. This vulnerability has a CVSS score of 5.5, indicating a local attack vector with low complexity, requiring local privileges, and primarily impacting data confidentiality. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has received some community discussion and media coverage, including mention in a Microsoft Patch Tuesday article.