Vulnerability · Published Aug 10, 2026 · Assigned by VulnCheck

CVE-2026-71969OP-TEE OS 4.10.0 Buffer Underwrite via RSA NOPAD Encrypt/Decrypt Operations

Medium 6.7

In plain English

A medium-severity out-of-bounds write in optee_os from OP-TEE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)0.2%top 92.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver that allows a malicious Trusted Application to corrupt secure-world heap memory by supplying an input length exceeding the RSA modulus size. When src_len exceeds rsa_len, the subtraction expression wraps to a large unsigned value, causing a subsequent memcpy to write attacker-controlled data before the destination buffer in S-EL1 secure-world heap memory.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	optee-os	no fix listed	DEBIAN-CVE-2026-71969
Ubuntu:26.04:LTS	optee-os	no fix listed	UBUNTU-CVE-2026-71969
Ubuntu:26.10	optee-os	no fix listed	UBUNTU-CVE-2026-71969

Affected products (as reported)

Vendor	Product	Versions
OP-TEE	optee_os	0 – through 4.10.0

Weakness: CWE-787, CWE-124 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Researcher Blog technical-description, exploit
Pull Request (1) issue-tracking
Pull Request (2) issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/op-tee-os-buffer-underwrite-via-rsa-nopad-encrypt-decrypt-operations third-party-advisory