OOP-TEE

Products

Exploited and recent CVEs

• CVE-2026-71969 Medium 6.7 OP-TEE OS 4.10.0 Buffer Underwrite via RSA NOPAD Encrypt/Decrypt Operations 0.2%
• CVE-2026-71968 Medium 6.7 OP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA_FLAG_CONCURRENT 0.1%
• CVE-2026-71967 Medium 5.5 OP-TEE OS 4.10.0 NULL Pointer Dereference DoS via Widevine PTA open_session 0.2%
• CVE-2026-53763 Low 3.8 OP-TEE has AES-GCM 32-bit integer overflow in length counters that breaks authentication guarantee 0.2%
• CVE-2026-44362 Medium 5.5 OP-TEE's subkey rollback protection can be bypassed with older subkey versions 0.2%
• CVE-2026-42546 Low 3.8 OP-TEE has missing OPTEE_MSG_ATTR_TYPE_MASK in cleanup_shm_refs() leaks mobj references 0.2%
• CVE-2026-41516 Low 2.5 OP-TEE: Hisilicon HPRE PKCS#1 v1.5 Decryption Padding Oracle 0.1%
• CVE-2026-41515 Low 2.5 OP-TEE: RSA-OAEP padding oracle in NXP CAAM driver enables plaintext recovery 0.1%
• CVE-2026-41514 Low 2.5 OP-TEE: RSA-OAEP padding oracle in Hisilicon HPRE driver enables plaintext recovery 0.1%
• CVE-2026-41434 Low 3.3 OP-TEE has unbounded recursion in sanitize_client_object() 0.2%
• CVE-2026-40257 Medium 5.5 OP-TEE has SHA-3 accelerated finalize heap overflow 0.2%
• CVE-2026-45702 Medium 4.4 OP-TEE has FF-A type confusion in SPMC tmem path that causes S-EL1 kernel panic 0.2%
• CVE-2026-45614 Medium 4.7 OP-TEE vulnerable to ECDH private key recovery <0.1%
• CVE-2026-40290 High 7.8 OP-TEE has a Use-After-Free race in FF-A shared-memory teardown 0.2%
• CVE-2026-33662 High 7.5 OP-TEE: RSASSA EMSA- PKCS1-v1_5 underflow in emsa_pkcs1_v1_5_encode() 0.4%
• CVE-2026-33317 High 8.7 OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure 0.2%
• CVE-2025-46733 High 7.9 REE userspace code can panic TAs, leading to fTPM PCR reset and data disclosure 0.2%
• CVE-2023-41325 High 7.4 OP-TEE double free in shdr_verify_signature 0.4%
• CVE-2022-46152 High 8.2 OP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs function 0.5%