EUVD-2026-41910Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Local normal-world caller with low privileges; no confidentiality or integrity impact; scope changes into secure world with low availability degradation.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.3.0 and prior to version 4.11.0, a resource leak exists in OP-TEE’s shared memory cleanup logic because the function cleanup_shm_refs() in core/tee/entry_std.c fails to apply a required bitmask (OPTEE_MSG_ATTR_TYPE_MASK) to parameter attributes. When processing non-contiguous memory parameters from a normal-world caller, the system fails to match the attribute type in its internal switch statement and skips the necessary mobj_put() call. This results in a persistent reference leak of mobj_reg_shm objects, which remain on internal lists with dangling refcounts. This affects non-FF-A configurations that support non-contiguous, non-secure shared memory. Over time, these accumulated leaks progressively consume the secure-world heap, degrading the system's ability to service trusted application operations and eventually requiring a reboot to recover. Version 4.11.0 contains a patch. No known workarounds are available.
AnalysisAI
Heap exhaustion in OP-TEE OS (versions 3.3.0 through 4.10.x) allows a low-privileged normal-world local caller to progressively degrade and ultimately deny service to all trusted applications running in the secure world. The root cause is a missing bitmask application in cleanup_shm_refs() that causes mobj_reg_shm reference objects to accumulate indefinitely on internal lists without being released. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local, low-privileged access to the normal world (Linux user space) on a device running OP-TEE in a non-FF-A configuration with non-contiguous, non-secure shared memory support enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS base score of 3.8 (Low) and the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L reflect a locally-triggered, low-complexity availability issue with a scope change into the secure world (S:C), but the impact on that scope is rated Low (A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unprivileged process on a Linux system running OP-TEE 3.3.0-4.10.x with non-FF-A and non-contiguous shared memory support repeatedly opens TEE sessions and passes non-contiguous memory parameters, causing `cleanup_shm_refs()` to skip `mobj_put()` on each invocation. Over thousands of calls, `mobj_reg_shm` objects accumulate on internal lists, progressively exhausting the secure-world heap until new trusted application operations - such as key storage reads, DRM license checks, or biometric authentication - begin failing, ultimately requiring a full device reboot to restore TEE functionality. … |
| Remediation | Upgrade OP-TEE OS to version 4.11.0, which contains the patch applying the `OPTEE_MSG_ATTR_TYPE_MASK` bitmask correctly in `cleanup_shm_refs()`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Subkey rollback protection in OP-TEE OS versions 3.20.0 through 4.10.x is completely non-functional due to a missing fie
Heap overflow in OP-TEE's ARM Crypto Extensions SHA-3 implementation corrupts TEE kernel memory across all platforms bui
Integer overflow in OP-TEE OS's AES-GCM implementation silently corrupts authentication tag computation when a single op
Stack exhaustion via unbounded recursion in the OP-TEE PKCS#11 Trusted Application allows a local low-privileged user to
RSA PKCS#1 v1.5 decryption in OP-TEE's Hisilicon HPRE hardware accelerator driver exposes a Bleichenbacher-style padding
RSA-OAEP decryption in OP-TEE OS versions 4.5.0 through 4.10.x exposes a Manger-style padding oracle via the Hisilicon H
RSA-OAEP decryption in OP-TEE OS versions 3.9.0 through 4.10.x exposes a Manger-style padding oracle via the NXP CAAM ha
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today