EUVD-2026-41912Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Local low-privilege TEE invocation required; when >512 MB threshold is met, AES-GCM integrity guarantee is fully defeated (I:H), not merely degraded; S:C retained as TEE secure-world impact crosses to REE.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.0.0 and prior to version 4.11.0, 32-bit integer overflows in OP-TEE core's AES-GCM implementation cause the authentication tag to be computed with incorrect bit-length values after processing more than 512 megabytes of payload or Additional Authenticated Data (AAD). Version 4.11.0 contains a patch. No known workarounds are available.
AnalysisAI
Integer overflow in OP-TEE OS's AES-GCM implementation silently corrupts authentication tag computation when a single operation processes more than 512 megabytes of payload or Additional Authenticated Data (AAD), affecting all deployments running versions 3.0.0 through 4.10.x on Arm TrustZone platforms. The overflow causes the GHASH length counters to wrap, meaning the GCM authentication tag is derived from incorrect bit-length values - defeating AES-GCM's core integrity guarantee without any runtime error or exception. No public exploit has been identified at time of analysis, but the practical impact for systems using OP-TEE for high-value integrity assurance (DRM, secure key storage, attestation) is significant when large payloads traverse the TEE boundary.
Technical ContextAI
OP-TEE OS (optee_os, CPE cpe:2.3:a:op-tee:optee_os:*:*:*:*:*:*:*:*) is an open-source TEE implementation built on Arm TrustZone technology, running in the secure world alongside a non-secure Linux kernel on Cortex-A processors. AES-GCM (Galois/Counter Mode) provides both confidentiality and authenticated integrity via a GHASH-based MAC; internally, GCM tracks message and AAD lengths in bits as inputs to the final authentication tag computation. The root cause is CWE-190 (Integer Overflow or Wraparound): the implementation uses 32-bit integers for these bit-length accumulators, which overflow silently when processing data exceeding 2^32 bits (approximately 512 MB). Once overflowed, the authentication tag is computed over a wrong length value, meaning tag verification against a tampered ciphertext or AAD may not detect the modification - the fundamental authenticated-encryption property collapses for that operation. The vulnerability spans all optee_os releases from 3.0.0 up to (but not including) 4.11.0.
RemediationAI
Upgrade OP-TEE OS to version 4.11.0 or later, which contains the vendor-confirmed patch for this integer overflow. The GitHub Security Advisory at https://github.com/OP-TEE/optee_os/security/advisories/GHSA-fcm8-vjhf-6vqh is the authoritative source. The vendor confirms no known workarounds are available. As a practical compensating control pending upgrade, platform engineers should enforce application-layer limits on AES-GCM operation sizes within Trusted Applications, capping single-call payload and AAD to well below 512 MB - for example, by chunking large data and using AES-GCM per-chunk with fresh nonces. This mitigation requires TA-level code changes, may introduce additional nonce management complexity, and adds per-chunk authentication overhead, but eliminates exposure to the overflow condition. For integrity-critical use cases (attestation, secure storage, DRM), treating this as a high-priority upgrade is advisable regardless of the low CVSS score.
Out-of-bounds read and write in OP-TEE OS PKCS#11 Trusted Application (versions 3.13.0-4.10.0) allows authenticated loca
Secure-world heap corruption in OP-TEE OS through 4.10.0 allows a malicious Trusted Application to write attacker-contro
Use-after-free in the OP-TEE OS Trusted Application loader (all versions through 4.10.0) allows an attacker who controls
Use-after-free race condition in OP-TEE OS versions 3.16.0 through 4.10.x enables local low-privileged attackers to corr
Integer overflow in OP-TEE OS RSA signature encoding crashes the Trusted Execution Environment on platforms with RSA har
Null pointer dereference in OP-TEE OS through version 4.10.0 allows a low-privileged Normal World process to crash the e
Subkey rollback protection in OP-TEE OS versions 3.20.0 through 4.10.x is completely non-functional due to a missing fie
Heap overflow in OP-TEE's ARM Crypto Extensions SHA-3 implementation corrupts TEE kernel memory across all platforms bui
Type confusion in OP-TEE OS versions 4.3.0 through 4.10.x allows a highly privileged local attacker operating in the nor
Private ECDH key recovery in OP-TEE prior to version 4.11.0 is achievable by a local attacker who can invoke TEE_DeriveK
Heap exhaustion in OP-TEE OS (versions 3.3.0 through 4.10.x) allows a low-privileged normal-world local caller to progre
Stack exhaustion via unbounded recursion in the OP-TEE PKCS#11 Trusted Application allows a local low-privileged user to
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today