What is the CVSS score of CVE-2026-53763?

CVE-2026-53763 has a CVSS 3.0 base score of 3.8 (Low). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-53763?

Yes, a patch is available for CVE-2026-53763. Update the affected software to the latest version immediately.

OP-TEE OS CVE-2026-53763

EUVD-2026-41912 LOW

Integer Overflow or Wraparound (CWE-190)

2026-07-06 GitHub_M

Integer Overflow Linux Buffer Overflow Optee Os

3.8

CVSS 3.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.8 LOW

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

vuln.today AI

6.5 MEDIUM

Local low-privilege TEE invocation required; when >512 MB threshold is met, AES-GCM integrity guarantee is fully defeated (I:H), not merely degraded; S:C retained as TEE secure-world impact crosses to REE.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 06, 2026 - 21:16 EUVD

Analysis Generated

Jul 06, 2026 - 20:13 vuln.today

CVE Published

Jul 06, 2026 - 19:35 cve.org

LOW 3.8

DescriptionCVE.org

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.0.0 and prior to version 4.11.0, 32-bit integer overflows in OP-TEE core's AES-GCM implementation cause the authentication tag to be computed with incorrect bit-length values after processing more than 512 megabytes of payload or Additional Authenticated Data (AAD). Version 4.11.0 contains a patch. No known workarounds are available.

AnalysisAI

Integer overflow in OP-TEE OS's AES-GCM implementation silently corrupts authentication tag computation when a single operation processes more than 512 megabytes of payload or Additional Authenticated Data (AAD), affecting all deployments running versions 3.0.0 through 4.10.x on Arm TrustZone platforms. The overflow causes the GHASH length counters to wrap, meaning the GCM authentication tag is derived from incorrect bit-length values - defeating AES-GCM's core integrity guarantee without any runtime error or exception. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain local low-privilege access to OP-TEE-enabled Arm device

Delivery

Invoke Trusted Application AES-GCM operation with >512 MB payload or AAD

Exploit

32-bit bit-length counter overflows in GHASH computation

Execution

Authentication tag derived from incorrect length values

Persist

Supply crafted ciphertext or AAD that passes corrupted tag verification

Impact

Tampered data accepted as authentic by relying application

Access

Obtain local low-privilege access to OP-TEE-enabled Arm device

Delivery

Invoke Trusted Application AES-GCM operation with >512 MB payload or AAD

Exploit

32-bit bit-length counter overflows in GHASH computation

Execution

Authentication tag derived from incorrect length values

Persist

Supply crafted ciphertext or AAD that passes corrupted tag verification

Impact

Tampered data accepted as authentic by relying application

Vulnerability AssessmentAI

Exploitation	Exploitation requires that a single AES-GCM operation within OP-TEE processes more than 512 megabytes (2^32 bits) of payload data or Additional Authenticated Data (AAD) - this is the specific threshold at which 32-bit integer counters overflow. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 3.0 base score of 3.8 (Low) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N reflects the local attack surface and limited integrity impact designation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A Trusted Application or REE process passes a single AES-GCM encryption or decryption call to OP-TEE with more than 512 MB of payload or AAD data. The internal 32-bit bit-length counter silently overflows during GHASH computation, causing the final authentication tag to be derived from an incorrect length value. …
Remediation	Upgrade OP-TEE OS to version 4.11.0 or later, which contains the vendor-confirmed patch for this integer overflow. … Detailed patch versions, workarounds, and compensating controls in full report.