The vulnerability resides in the RSA‑OAEP decryption routine of the Hisilicon HPRE crypto driver in OP‑TEE. A non‑constant‑time memcmp is used to verify the label hash, and the function exposes multiple distinguishable error paths. This combination creates a Manger‑style padding oracle that enables an attacker to recover the plaintext of an RSA‑OAEP encrypted message after approximately 1,000‑2,000 adaptive chosen‑ciphertext queries. The weakness corresponds to CWE‑208 and results in plaintext recovery without providing code execution or privilege escalation.

Affected deployments are OP‑TEE operating system versions from 4.5.0 up to, but not including, 4.11.0 when built for the plat‑d06 platform with the compiler configuration option CFG_HISILICON_ACC_V3 set to "y". This option is disabled by default, so the flaw only applies to systems that explicitly enable the Hisilicon accelerator support.

The CVSS score of 2.5 indicates low severity, and the EPSS score of less than 1% reflects a very low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is local to the trusted execution environment; an attacker must be able to submit multiple decryption requests and observe the distinct error responses, which limits the attack surface. The minimal exposure in the default configuration and the requirement for a large number of queries make active exploitation unlikely in most scenarios. A patch is available in version 4.11.0.