EUVD-2026-55696
GHSA-cg97-7v4v-qg3v
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector (AV:L) with low privilege (PR:L); high complexity (AC:H) because CFG_WIDEVINE_PTA non-default build flag is a specific prerequisite; availability-only impact (A:H) crashes TEE.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA open_session handler that allows Normal World clients to cause a denial of service when CFG_WIDEVINE_PTA is enabled. Attackers can open a session directly on the Widevine PTA to trigger an unconditional dereference of a NULL calling session pointer via is_user_ta_ctx(), faulting the TEE at S-EL1 and crashing the trusted execution environment.
AnalysisAI
Null pointer dereference in OP-TEE OS through version 4.10.0 allows a low-privileged Normal World process to crash the entire Trusted Execution Environment by opening a session directly on the Widevine pseudo-TA when CFG_WIDEVINE_PTA is enabled. The open_session handler in core/pta/widevine.c calls is_user_ta_ctx(session->ctx) without first checking that session is non-NULL, faulting the TEE at S-EL1 and making all TEE services - including secure key storage and other Trusted Applications - unavailable until reboot. No public exploit code exists and no CISA KEV listing is present; the upstream fix is confirmed by commit 0aadfc2 and the CVSS 4.0 score of 5.7 reflects the local, low-privilege, configuration-dependent exploitation conditions.
Technical ContextAI
OP-TEE OS is an open-source Trusted Execution Environment compliant with GlobalPlatform TEE specifications, executing at ARM Secure EL1 (S-EL1) and providing an isolated secure runtime for Trusted Applications (TAs). The Widevine pseudo-TA (PTA) is an optional component that provides DRM key management services to Normal World clients and is compiled in only when CFG_WIDEVINE_PTA is set at build time. The root cause is CWE-476 (NULL Pointer Dereference): the open_session handler at core/pta/widevine.c directly calls is_user_ta_ctx(session->ctx) without first verifying that the session pointer itself is non-NULL. When a Normal World client opens a session on the Widevine PTA and the TEE passes a NULL calling-session pointer, the unconditional dereference produces a fault at S-EL1, crashing the TEE. The upstream fix (commit 0aadfc23407f50e770eb5ddd871fc208f5626833) adds the guard condition if (!session || !is_user_ta_ctx(session->ctx)). The affected CPE is cpe:2.3:a:op-tee:optee_os:*:*:*:*:*:*:*:* covering all builds through 4.10.0 compiled with the Widevine PTA enabled.
RemediationAI
The primary fix is to cherry-pick or incorporate commit 0aadfc23407f50e770eb5ddd871fc208f5626833 into the OP-TEE OS build (https://github.com/OP-TEE/optee_os/commit/0aadfc23407f50e770eb5ddd871fc208f5626833); this adds a NULL check before the dereference and is a minimal, non-breaking change. A tagged released version containing this fix was not independently confirmed - monitor PR #7899 (https://github.com/OP-TEE/optee_os/pull/7899) and the official OP-TEE release page for a formal version bump. As an effective compensating control, rebuild OP-TEE OS without the CFG_WIDEVINE_PTA flag; this eliminates the vulnerable code path entirely but removes Widevine DRM support from the TEE, which will break content protection for DRM-gated media on that device - a significant trade-off for consumer media platforms. Where the build configuration cannot be changed immediately, restricting Normal World process permissions to invoke TEEC_OpenSession against the Widevine PTA via platform-level access control (e.g., Android SELinux policy) reduces the attack surface to privileged processes only, increasing the effective privilege bar above PR:L.
Out-of-bounds read and write in OP-TEE OS PKCS#11 Trusted Application (versions 3.13.0-4.10.0) allows authenticated loca
Secure-world heap corruption in OP-TEE OS through 4.10.0 allows a malicious Trusted Application to write attacker-contro
Use-after-free in the OP-TEE OS Trusted Application loader (all versions through 4.10.0) allows an attacker who controls
Use-after-free race condition in OP-TEE OS versions 3.16.0 through 4.10.x enables local low-privileged attackers to corr
Integer overflow in OP-TEE OS RSA signature encoding crashes the Trusted Execution Environment on platforms with RSA har
Subkey rollback protection in OP-TEE OS versions 3.20.0 through 4.10.x is completely non-functional due to a missing fie
Heap overflow in OP-TEE's ARM Crypto Extensions SHA-3 implementation corrupts TEE kernel memory across all platforms bui
Type confusion in OP-TEE OS versions 4.3.0 through 4.10.x allows a highly privileged local attacker operating in the nor
Private ECDH key recovery in OP-TEE prior to version 4.11.0 is achievable by a local attacker who can invoke TEE_DeriveK
Integer overflow in OP-TEE OS's AES-GCM implementation silently corrupts authentication tag computation when a single op
Heap exhaustion in OP-TEE OS (versions 3.3.0 through 4.10.x) allows a low-privileged normal-world local caller to progre
Stack exhaustion via unbounded recursion in the OP-TEE PKCS#11 Trusted Application allows a local low-privileged user to
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today