EUVD-2026-55699
GHSA-hg7c-pmh6-576f
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L and PR:H because exploitation requires executing a malicious TA inside the TEE; S:C because the TA at S-EL0 corrupts the OP-TEE OS at S-EL1, crossing a privilege boundary within the secure world.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver that allows a malicious Trusted Application to corrupt secure-world heap memory by supplying an input length exceeding the RSA modulus size. When src_len exceeds rsa_len, the subtraction expression wraps to a large unsigned value, causing a subsequent memcpy to write attacker-controlled data before the destination buffer in S-EL1 secure-world heap memory.
AnalysisAI
Secure-world heap corruption in OP-TEE OS through 4.10.0 allows a malicious Trusted Application to write attacker-controlled data before a destination buffer in S-EL1 memory via RSA NOPAD encrypt and decrypt operations. The flaw exists in both the mbedTLS software cryptographic backend and the NXP SE050 hardware driver: when the caller supplies an input length exceeding the RSA modulus size, an unsigned integer underflow in the size subtraction produces a huge value, causing a subsequent memcpy to write well before the intended destination buffer in the secure-world heap. No public exploit has been identified at time of analysis; the upstream fix is available at commit 7b8b494 in the OP-TEE GitHub repository.
Technical ContextAI
OP-TEE OS (CPE: cpe:2.3:a:op-tee:optee_os:*:*:*:*:*:*:*:*) is the reference implementation of a Trusted Execution Environment OS running at Arm TrustZone privilege level S-EL1. Trusted Applications (TAs) execute at S-EL0 and invoke TEE internal core APIs, including raw RSA NOPAD cipher operations. The defect, classified as CWE-787 (Out-of-bounds Write), is specifically a buffer underwrite: both decrypt_nopad and encrypt_nopad omitted a guard on src_len before computing the padding offset as rsa_len - src_len. When src_len > rsa_len, C unsigned arithmetic wraps to a very large positive value, so the subsequent memcpy treats that value as a write offset and writes attacker-supplied bytes into heap memory significantly before the destination buffer. The same logic flaw appeared independently in lib/libmbedtls/core/rsa.c (software path) and core/drivers/crypto/se050/core/rsa.c (SE050 hardware driver path), widening the affected surface to all OP-TEE cryptographic configurations. The fix, visible in PRs #7808 and #7898, inserts an explicit src_len > rsa_len check returning TEE_ERROR_BAD_PARAMETERS before any arithmetic proceeds.
RemediationAI
Apply upstream fix commit 7b8b494e0a324cefec8ed386b7de413b44f1aaf3, available via OP-TEE GitHub PRs #7808 (https://github.com/OP-TEE/optee_os/pull/7808) and #7898 (https://github.com/OP-TEE/optee_os/pull/7898). A specific tagged OP-TEE release incorporating this fix has not been independently confirmed - monitor the OP-TEE release cadence and upgrade to the first release after commit 7b8b494 once tagged. As a compensating control, enforce strict Trusted Application signing policies using a hardware-protected TA signing key: this eliminates the malicious TA prerequisite entirely and mitigates the attack without patching, though it does not remove the underlying flaw and adds operational overhead for TA management. Additionally, restrict TA-to-TA and TA-to-OS capability grants via OP-TEE access control to limit which TAs can invoke raw RSA NOPAD operations, reducing the exploitable surface area. Refer to the VulnCheck advisory for additional context: https://www.vulncheck.com/advisories/op-tee-os-buffer-underwrite-via-rsa-nopad-encrypt-decrypt-operations.
Out-of-bounds read and write in OP-TEE OS PKCS#11 Trusted Application (versions 3.13.0-4.10.0) allows authenticated loca
Use-after-free in the OP-TEE OS Trusted Application loader (all versions through 4.10.0) allows an attacker who controls
Use-after-free race condition in OP-TEE OS versions 3.16.0 through 4.10.x enables local low-privileged attackers to corr
Integer overflow in OP-TEE OS RSA signature encoding crashes the Trusted Execution Environment on platforms with RSA har
Null pointer dereference in OP-TEE OS through version 4.10.0 allows a low-privileged Normal World process to crash the e
Subkey rollback protection in OP-TEE OS versions 3.20.0 through 4.10.x is completely non-functional due to a missing fie
Heap overflow in OP-TEE's ARM Crypto Extensions SHA-3 implementation corrupts TEE kernel memory across all platforms bui
Type confusion in OP-TEE OS versions 4.3.0 through 4.10.x allows a highly privileged local attacker operating in the nor
Private ECDH key recovery in OP-TEE prior to version 4.11.0 is achievable by a local attacker who can invoke TEE_DeriveK
Integer overflow in OP-TEE OS's AES-GCM implementation silently corrupts authentication tag computation when a single op
Heap exhaustion in OP-TEE OS (versions 3.3.0 through 4.10.x) allows a low-privileged normal-world local caller to progre
Stack exhaustion via unbounded recursion in the OP-TEE PKCS#11 Trusted Application allows a local low-privileged user to
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today