OP-TEE OS, a Trusted Execution Environment for ARM platforms, contains a flaw in its Elliptic Curve Diffie–Hellman (ECDH) key‑derivation routine. A public key supplied to TEE_DeriveKey is not checked to be a valid point on the expected elliptic curve. When an attacker supplies approximately 30–40 specially crafted points, each DeriveKey call leaks partial information about the internal key. Repeating the process and applying the Chinese remainder theorem enables the attacker to recover the entire private key that stores cryptographic material for the secure world. This issue is rooted in CWE-347, which denotes false or incomplete input validation.

The vulnerability affects OP-TEE OS versions earlier than 4.11.0. The patch in v4.11.0 adds proper point validation for all supported curves. All builds of the official OP-TEE repository before that release are vulnerable; custom or forked builds lacking the fix are also impacted.

The CVSS score of 4.7 indicates moderate risk. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog. Attackers must be able to invoke the TEE_DeriveKey API from the normal world, which typically requires local access to the device. The vulnerability requires multiple interactions with the API—approximately 30–40 calls—to accumulate enough leaked data before the private key can be reconstructed. Based on the description, it is inferred that a local attacker on the same hardware can exploit this path, but a remote attacker without device access is unlikely to succeed.