The TPM2 Software Stack Project maintains a narrowly scoped set of libraries and utilities for Trusted Platform Module 2.0 integration, which despite limited product breadth sits in the firmware and system-level software across a broad range of platforms and devices. Its observed vulnerability signal concentrates on memory-safety issues—specifically classic buffer overflows and missing resource initialization—characteristic of C-based system software operating at privileged levels. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tpm2 Software Stack Project over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-24455MEDIUM Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before | Feb 26, 2021 | 6.7 | 23 | NO | NO |
CVE-2023-22745MEDIUM tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1 | Jan 19, 2023 | 6.4 | 22 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tpm2 Software Stack Project.
Media articles that mention a CVE ID that affects a product developed by Tpm2 Software Stack Project — matched by CVE ID, not by vendor name.