OP-TEE: Five TEE Vulnerabilities Disclosed Together, Affecting Crypto and Stability
Five vulnerabilities affecting OP-TEE, a Trusted Execution Environment for Arm systems, were disclosed on July 8, 2026, impacting versions prior to 4.11.0.
Key findings
- Five vulnerabilities disclosed on July 8, 2026, affecting OP-TEE versions prior to 4.11.0.
- Flaws include integer overflows, unbounded recursion, resource leaks, and crypto implementation errors.
- Vulnerabilities impact AES-GCM, PKCS#11 TA, shared memory cleanup, subkey rollback protection, and SHA-3 implementation.
- Affected versions range from 3.0.0 up to (but not including) 4.11.0.
- Version 4.11.0 contains patches for the disclosed vulnerabilities.
On July 8, 2026, a batch of five vulnerabilities was disclosed for OP-TEE, a Trusted Execution Environment (TEE) designed to complement non-secure Linux kernels on Arm Cortex-A cores utilizing TrustZone technology. The vulnerabilities, all affecting versions prior to 4.11.0, span several bug classes including integer overflows, unbounded recursion, resource leaks, and implementation errors in cryptographic functions. These issues collectively impact the security and stability of the TEE, potentially compromising sensitive operations.
Several of the disclosed vulnerabilities stem from flaws in cryptographic implementations and protections. CVE-2026-53763 details 32-bit integer overflows within OP-TEE core's AES-GCM implementation, leading to issues with the authentication tag. Similarly, CVE-2026-40257 highlights an off-by-one error in the ARM Crypto Extensions accelerated SHA-3 implementation. These cryptographic weaknesses could potentially undermine data integrity and confidentiality.
Other vulnerabilities focus on stability and resource management. CVE-2026-41434 describes an unbounded recursion in the PKCS#11 Trusted Application (TA) that can lead to a crash. CVE-2026-42546 points to a resource leak in the shared memory cleanup logic due to an issue in the cleanup_shm_refs() function. Additionally, CVE-2026-44362 reveals a vulnerability in OP-TEE’s subkey rollback protection, allowing the use of revoked or older subkey versions.
The disclosed vulnerabilities affect OP-TEE versions starting from 3.0.0, 3.10.0, 3.20.0, 3.3.0, and 3.21.0, up to, but not including, version 4.11.0. The release of version 4.11.0 is noted as containing a patch for CVE-2026-41434, and it is implied that this version addresses the other vulnerabilities in the batch as well. No known workarounds are mentioned for these issues, emphasizing the importance of updating to a patched version.
This coordinated disclosure of five distinct vulnerabilities underscores the importance of maintaining up-to-date TEE environments for secure processing on Arm-based systems. Users of OP-TEE are strongly advised to upgrade to version 4.11.0 or later to mitigate these security risks. The variety of flaws, from cryptographic implementation errors to resource management issues, highlights the multifaceted security considerations for Trusted Execution Environments.