OP-TEE’s sanitize_client_object() function contains an unbounded recursion that can cause the PKCS#11 Trusted Application to crash. The crash results in a denial of service for any application that relies on that Trusted Application. The weakness is a stack-based overflow (CWE-121).

The problem exists in the OP-TEE optee_os product from release 3.10.0 up to, but not including, 4.11.0. Systems that run these releases are affected until the firmware is updated to version 4.11.0 or newer.

The CVSS score of 3.3 indicates low severity, and the EPSS score is below 1 %, showing a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local interaction with the Trusted Execution Environment through malformed PKCS#11 requests. The attack surface appears to be the local TEE, where this recursion may be triggered and exhaust the stack. Consequently, widespread public exploitation is unlikely, but local attackers with privileges to interact with the TEE could cause repeated service interruptions.