CVE-2026-6726 — Out-of-Bounds Read / Improper Object Slot Reuse

• Type: Out-of-bounds read vulnerability in the TPM 2.0 reference implementation .
• CVSS scores: 8.5 (CVSS v4.0, High) — Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N ; 7.9 (CVSS v3.1, High) — Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N .
• Access conditions: Local attacker with elevated privileges (PR:H) who can send malicious commands to the TPM from user-mode applications .
• Impact: Information leakage allowing an attacker to obtain credentials from a TPM-aware Certificate Authority (CA) for a falsified TPM key (e.g., Attestation Key, DevID Key, TLS authentication key). This can lead to forgery of TPM encryption keys and other TPM-based attestation mechanisms .

CVE-2026-6727 — Timing Side-Channel in RSA OAEP Decryption

• Type: Timing side-channel in the RSA OAEP decryption implementation .
• CVSS scores: 8.3 (CVSS v4.0, High) per some reporting ; 5.9 (CVSS v3.1, Medium) from CISA-ADP — Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N ; 5.9 (CVSS v3.1, Important) in Microsoft's Patch Tuesday listing .
• Access conditions: Privileged local attacker with access to the TPM command interface. The attack is non-trivial due to the "High" attack complexity (AC:H) and requires physical or local system access .
• Impact: Timing differences can be exploited to recover information allowing decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), import blobs, credential blobs, and session salts. Under certain conditions, this may also enable forgery of TPM 2.0 attestations .

Affected Products

The vulnerabilities span an exceptionally broad range of AMD processors:

• Desktop: Ryzen 3000, 4000, 5000, 7000, 8000, and 9000 series
• Mobile: Ryzen AI 300/400, Ryzen AI Max 300, Ryzen 3000–5000 Mobile series
• Workstation: Ryzen Threadripper PRO (5000WX, 7000WX series) and Threadripper
• Server: EPYC 4004 and 4005 series
• Embedded: Multiple Ryzen Embedded and EPYC Embedded families
• Other: Ryzen Z1/Z2 series (handheld gaming PC processors)

Patch Timeline

• May–June 2026: AMD began distributing Platform Initialization (PI) firmware fixes to OEM and motherboard partners. For example, the ComboAM5PI 1.2.0.3k update (covering EPYC 4004 and Ryzen 7000/9000 series) was released May 31, 2026 .
• By June 17, 2026: NVD records show affected-product lists being updated with PI package versions and release dates .
• August 11–13, 2026: AMD publicly disclosed both vulnerabilities via AMD-SB-7064; ASUS, MSI, Gigabyte, and ASRock had already pushed patched BIOS updates .

Broader August Patch Tuesday Context

Both CVEs were republished by MITRE and appeared in Microsoft's August 2026 Patch Tuesday (August 11, 2026) under the "Windows TPM" tag, rated Important severity . However, Microsoft did not release a Windows-side security update or KB article for either CVE — only the underlying TPM firmware (BIOS/UEFI) update from the hardware vendor remediates the flaw . The August 2026 Patch Tuesday batch overall addressed 421 CVEs, with these TPM vulnerabilities being high-profile items due to the broad AMD product scope and the origin of the disclosure (Intel researchers reporting TPM bugs affecting AMD systems) .

What Users Should Do

Both vulnerabilities require local privileged access, meaning the risk for home users is low, but enterprise customers should prioritize BIOS updates on shared or multi-user systems. To mitigate the risk:

1. Check your motherboard vendor's website (ASUS, MSI, Gigabyte, ASRock, etc.) for a BIOS update referencing AMD-SB-7064 or ComboAM5PI 1.2.0.3k or later.
2. Apply the BIOS update following the manufacturer's instructions.
3. Verify the update includes the platform initialization (PI) fixes dated May–June 2026 or later.

CVE-2026-6726 — Out-of-Bounds Read / Improper Object Slot Reuse

• Type: Out-of-bounds read vulnerability in the TPM 2.0 reference implementation .
• CVSS scores: 8.5 (CVSS v4.0, High) — Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N ; 7.9 (CVSS v3.1, High) — Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N .
• Access conditions: Local attacker with elevated privileges (PR:H) who can send malicious commands to the TPM from user-mode applications .
• Impact: Information leakage allowing an attacker to obtain credentials from a TPM-aware Certificate Authority (CA) for a falsified TPM key (e.g., Attestation Key, DevID Key, TLS authentication key). This can lead to forgery of TPM encryption keys and other TPM-based attestation mechanisms .

CVE-2026-6727 — Timing Side-Channel in RSA OAEP Decryption

• Type: Timing side-channel in the RSA OAEP decryption implementation .
• CVSS scores: 8.3 (CVSS v4.0, High) per some reporting ; 5.9 (CVSS v3.1, Medium) from CISA-ADP — Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N ; 5.9 (CVSS v3.1, Important) in Microsoft's Patch Tuesday listing .
• Access conditions: Privileged local attacker with access to the TPM command interface. The attack is non-trivial due to the "High" attack complexity (AC:H) and requires physical or local system access .
• Impact: Timing differences can be exploited to recover information allowing decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), import blobs, credential blobs, and session salts. Under certain conditions, this may also enable forgery of TPM 2.0 attestations .

Affected Products

The vulnerabilities span an exceptionally broad range of AMD processors:

• Desktop: Ryzen 3000, 4000, 5000, 7000, 8000, and 9000 series
• Mobile: Ryzen AI 300/400, Ryzen AI Max 300, Ryzen 3000–5000 Mobile series
• Workstation: Ryzen Threadripper PRO (5000WX, 7000WX series) and Threadripper
• Server: EPYC 4004 and 4005 series
• Embedded: Multiple Ryzen Embedded and EPYC Embedded families
• Other: Ryzen Z1/Z2 series (handheld gaming PC processors)

Patch Timeline

• May–June 2026: AMD began distributing Platform Initialization (PI) firmware fixes to OEM and motherboard partners. For example, the ComboAM5PI 1.2.0.3k update (covering EPYC 4004 and Ryzen 7000/9000 series) was released May 31, 2026 .
• By June 17, 2026: NVD records show affected-product lists being updated with PI package versions and release dates .
• August 11–13, 2026: AMD publicly disclosed both vulnerabilities via AMD-SB-7064; ASUS, MSI, Gigabyte, and ASRock had already pushed patched BIOS updates .

Broader August Patch Tuesday Context

Both CVEs were republished by MITRE and appeared in Microsoft's August 2026 Patch Tuesday (August 11, 2026) under the "Windows TPM" tag, rated Important severity . However, Microsoft did not release a Windows-side security update or KB article for either CVE — only the underlying TPM firmware (BIOS/UEFI) update from the hardware vendor remediates the flaw . The August 2026 Patch Tuesday batch overall addressed 421 CVEs, with these TPM vulnerabilities being high-profile items due to the broad AMD product scope and the origin of the disclosure (Intel researchers reporting TPM bugs affecting AMD systems) .

What Users Should Do

Both vulnerabilities require local privileged access, meaning the risk for home users is low, but enterprise customers should prioritize BIOS updates on shared or multi-user systems. To mitigate the risk:

1. Check your motherboard vendor's website (ASUS, MSI, Gigabyte, ASRock, etc.) for a BIOS update referencing AMD-SB-7064 or ComboAM5PI 1.2.0.3k or later.
2. Apply the BIOS update following the manufacturer's instructions.
3. Verify the update includes the platform initialization (PI) fixes dated May–June 2026 or later.