EUVD-2026-41893Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Local-only attack requiring TEE client API access (AV:L, PR:L); crash of PKCS#11 TA yields limited availability impact only, no data exposure or integrity change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS#11 TA. Version 4.11.0 contains a patch. No known workarounds are available.
AnalysisAI
Stack exhaustion via unbounded recursion in the OP-TEE PKCS#11 Trusted Application allows a local low-privileged user to crash the TA, causing a denial of service within the TrustZone secure world. Affected versions span 3.10.0 through 4.10.x of optee_os running on Arm Cortex-A platforms with TrustZone enabled. No active exploitation has been identified; this is a DoS-only issue with no confidentiality or integrity impact, and a patched release (4.11.0) is available.
Technical ContextAI
OP-TEE (Open Portable Trusted Execution Environment) implements the GlobalPlatform TEE specification as a companion OS running in the Arm TrustZone secure world alongside a non-secure Linux kernel on Cortex-A cores. The vulnerable component is the PKCS#11 Trusted Application (TA), which provides a TEE-resident cryptographic token interface conforming to the PKCS#11 standard. CWE-121 (Stack-based Buffer Overflow) is the assigned root cause class; in this instance the mechanism is unbounded recursion rather than a classic write-past-end-of-buffer, but the result is stack exhaustion within the TA's secure-world stack, which is strictly bounded. The affected CPE is cpe:2.3:a:op-tee:optee_os:*:*:*:*:*:*:*:* spanning versions 3.10.0 through pre-4.11.0, as confirmed by the GitHub Security Advisory GHSA-wh38-23ff-grff.
RemediationAI
Upgrade optee_os to version 4.11.0, which contains the patch for this vulnerability as confirmed by the GitHub Security Advisory GHSA-wh38-23ff-grff (https://github.com/OP-TEE/optee_os/security/advisories/GHSA-wh38-23ff-grff). The vendor states no known workarounds are available, so patching is the only remediation path. For environments where an immediate upgrade to 4.11.0 is not feasible, operators may consider disabling or not loading the PKCS#11 TA if it is not required by the application, at the trade-off of losing PKCS#11 cryptographic token functionality in the secure world. Restricting which non-secure world processes can communicate with the PKCS#11 TA via TEE client API access controls may reduce the attack surface but does not eliminate the vulnerability.
Out-of-bounds read and write in OP-TEE OS PKCS#11 Trusted Application (versions 3.13.0-4.10.0) allows authenticated loca
Secure-world heap corruption in OP-TEE OS through 4.10.0 allows a malicious Trusted Application to write attacker-contro
Use-after-free in the OP-TEE OS Trusted Application loader (all versions through 4.10.0) allows an attacker who controls
Use-after-free race condition in OP-TEE OS versions 3.16.0 through 4.10.x enables local low-privileged attackers to corr
Integer overflow in OP-TEE OS RSA signature encoding crashes the Trusted Execution Environment on platforms with RSA har
Null pointer dereference in OP-TEE OS through version 4.10.0 allows a low-privileged Normal World process to crash the e
Subkey rollback protection in OP-TEE OS versions 3.20.0 through 4.10.x is completely non-functional due to a missing fie
Heap overflow in OP-TEE's ARM Crypto Extensions SHA-3 implementation corrupts TEE kernel memory across all platforms bui
Type confusion in OP-TEE OS versions 4.3.0 through 4.10.x allows a highly privileged local attacker operating in the nor
Private ECDH key recovery in OP-TEE prior to version 4.11.0 is achievable by a local attacker who can invoke TEE_DeriveK
Integer overflow in OP-TEE OS's AES-GCM implementation silently corrupts authentication tag computation when a single op
Heap exhaustion in OP-TEE OS (versions 3.3.0 through 4.10.x) allows a low-privileged normal-world local caller to progre
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today