CVE-2023-1018 - CVE House
Back to Database
Status published Unknown CVE-2023-1018

TPM2.0 vulnerable to out-of-bounds read

Vulnerability Description

An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-1018

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Francisco Falcon of Quarkslab

References

More from Trusted Computing Group

View All →
CVE-2025-2884
Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation
Unknown 0
CVE-2023-1017
TPM2.0 vulnerable to out-of-bounds write
Unknown 0

Affected Vendor

Trusted Computing Group

View all reports →

Affected Software

TPM2.0
Vulnerable Versions:
1.59, 1.38, 1.16

Timeline

Official Publish: February 28th, 2023
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.