The Trusted Computing Group maintains specifications and reference implementations for Trusted Platform Module (TPM) technology and related firmware-attestation frameworks; vulnerabilities affecting this vendor concentrate in foundational components such as the TPM specification itself and open-source implementations like TrouSerS, which sit at the hardware-software boundary across many platforms. The recurring weakness classes—improper initialization, link-following conditions, buffer-boundary violations, and out-of-bounds reads—reflect the low-level complexity of cryptographic state management and privileged hardware interfaces. Defenders should treat TPM firmware and driver updates as part of platform baseline hardening, since these components operate below the operating system and control root-of-trust anchors; current exposure and exploitation trends are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Trustedcomputinggroup over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-0698MEDIUM tcsd in TrouSerS before 0.3.10 allows remote attackers to cause a denial of service (daemon crash) via a crafted type_offset value in a TCP packet to port 30003. | Nov 26, 2012 | 5.0 | 34 | NO | YES |
CVE-2023-1017HIGH An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An | Feb 28, 2023 | 7.8 | 26 | NO | NO |
CVE-2018-6622HIGH An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an obscure portion of the Trusted Computing Group (TCG) Trusted P | Aug 17, 2018 | 7.1 | 24 | NO | NO |
CVE-2023-1018MEDIUM An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker w | Feb 28, 2023 | 5.5 | 22 | NO | NO |
CVE-2020-24332MEDIUM An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss us | Aug 13, 2020 | 5.5 | 20 | NO | NO |
CVE-2020-26933MEDIUM Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shu | Nov 18, 2020 | 6.0 | 19 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Trustedcomputinggroup.
Media articles that mention a CVE ID that affects a product developed by Trustedcomputinggroup — matched by CVE ID, not by vendor name.