CVE-2024-32482: Tillitis TKey Signer possible RAM disclosure vulnerability
Vulnerability summary
CVE-2024-32482 is a low (CVSS 2.2) Out-of-bounds Read vulnerability in tillitis tkey-device-signer. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.5% of scored vulnerabilities.
Not severe (CVSS 2.2, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 23-04-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret is disclosed. All client applications integrating tkey-device-signer should upgrade to version 1.0.0 to receive a fix. No known workarounds are available.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST2.2LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.11% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Affected systems
Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Tillitis1 product
- tkey-device-signer< 1.0.0
1 vendor · 1 product