Description
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS#11 TA. Version 4.11.0 contains a patch. No known workarounds are available.
Published: 2026-07-06
Score: 3.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

OP‑TEE’s sanitize_client_object() routine can recurse without bound when handling certain PKCS#11 client objects, exhausting the stack and crashing the Trusted Application. The crash stops the application from processing further requests, effectively denying service to any user or process relying on that Trusted Application. The underlying weakness is a classic stack‑based buffer overflow (CWE‑121).

Affected Systems

All supported releases of the OP‑TEE optee_os kernel from version 3.10.0 up to, but excluding, 4.11.0 are vulnerable. Systems running one of these firmware releases need to be updated to 4.11.0 or a newer patch version to eliminate the recursion bug.

Risk and Exploitability

The CVSS score of 3.3 categorizes the vulnerability as low severity, and the EPSS score of less than 1 % indicates a very small chance of exploitation. The weakness is not included in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires local interaction with the TEE, such as a malicious PKCS#11 request crafted by a user with privileges to invoke the Trusted Application. While widespread public exploitation is unlikely, local attackers could repeatedly trigger service interruptions by sending malformed requests.

Generated by OpenCVE AI on August 1, 2026 at 18:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OP‑TEE firmware to version 4.11.0 or later, which contains the recursion guard.
  • Configure the PKCS#11 Trusted Application to allow only trusted services or privileged users to invoke it so that untrusted code cannot trigger the recursion.
  • Enable and watch TEE logs or audit trails for repeated TA crashes to detect possible abuse attempts.

Generated by OpenCVE AI on August 1, 2026 at 18:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Op-tee
Op-tee op-tee Os
Vendors & Products Op-tee
Op-tee op-tee Os

Mon, 06 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Description OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS#11 TA. Version 4.11.0 contains a patch. No known workarounds are available.
Title OP-TEE has unbounded recursion in sanitize_client_object()
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Op-tee Op-tee Os
Trustedfirmware Op-tee
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-07T15:06:13.052Z

Reserved: 2026-04-20T15:32:33.815Z

Link: CVE-2026-41434

cve-icon Vulnrichment

Updated: 2026-07-07T15:06:05.969Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-06T18:16:43.923

Modified: 2026-07-07T18:53:03.177

Link: CVE-2026-41434

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T18:30:05Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow