EUVD-2026-34159Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Prior to version 4.11.0, on many of the ECDH shared secret paths, the public key isn't verified to be a point on the correct curve. By passing approximately 30-40 crafted public keys to OP-TEE, the private key can be reconstructed by a normal world attacker. When calling TEE_DeriveKey the public key is provided with full X and Y values, but the (X, Y) point might not satisfy the Y^2 == X^3 + aX + b mod P math for the specific curve that is used. When those public keys aren't rejected, the attacker can select public keys such that each DeriveKey call will leak d % r where d is the private key and r comes from the relationship between the correct curve and the attacker selected curve. With enough leaked data the Chinese remainder theorem can be used to recover the full private key. Version 4.11.0 fixes the issue.
AnalysisAI
Private ECDH key recovery in OP-TEE prior to version 4.11.0 is achievable by a local attacker who can invoke TEE_DeriveKey with approximately 30-40 crafted public key values lying off the target elliptic curve. Because the implementation omits point validation - failing to verify that (X, Y) satisfies Y^2 ≡ X^3 + aX + b mod P for the specified curve - each malformed call leaks a residue d mod r, where d is the private key and r is the order of the attacker-chosen invalid curve. Accumulated residues allow full private key reconstruction via the Chinese Remainder Theorem. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the underlying invalid curve attack technique is well-documented in cryptographic literature and reproducible by any skilled attacker with local access.
Technical ContextAI
OP-TEE is an open-source Trusted Execution Environment (TEE) built on Arm TrustZone technology, executing in the Secure World alongside a normal Linux kernel on Cortex-A processors. The affected component is the ECDH shared secret derivation path exposed via the GlobalPlatform TEE Internal Core API function TEE_DeriveKey. The caller supplies a public key as explicit (X, Y) elliptic curve coordinates, but the implementation does not validate that the point satisfies the curve equation for the named curve - a mandatory step in safe ECDH implementations. This omission enables the classic invalid curve attack: by selecting points from small-order subgroups of related curves, an attacker forces scalar multiplication against a point of known low order, leaking d mod r for each chosen r. Repeating the process with distinct r values and applying the Chinese Remainder Theorem recovers d entirely. CWE-347 (Improper Verification of Cryptographic Signature) identifies the root cause class - a required cryptographic validation step (curve membership check) is absent. The CPE cpe:2.3:a:op-tee:optee_os:*:*:*:*:*:*:*:* covers all optee_os versions, with all releases prior to 4.11.0 confirmed affected.
RemediationAI
Upgrade OP-TEE OS to version 4.11.0, which introduces mandatory point validation to reject public keys not satisfying the curve equation before ECDH scalar multiplication proceeds. The vendor advisory is available at https://github.com/OP-TEE/optee_os/security/advisories/GHSA-g6qf-hwf7-mg9h. For deployments where immediate upgrade is not feasible, a compensating control is to implement curve membership validation within the Trusted Application (TA) layer before passing the public key to TEE_DeriveKey - this adds a defense-in-depth layer but requires TA modification and redeployment. A second option is to restrict TEE_DeriveKey invocation to trusted callers via TA access control policies, reducing the attacker's ability to make repeated crafted calls; this may disrupt legitimate use cases if the TA is designed for broad client access. Generic network-level controls are not applicable given the local attack vector.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today