Is CVE-2026-33317 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33317 being exploited in the wild.

How severe is CVE-2026-33317?

High severity, with a CVSS score of 8.7, published 24 April 2026.

Which products and versions are affected?

TrustedFirmware OP-TEE OS 3.13.0 through 4.10.0.

Is there a fix for CVE-2026-33317?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33317 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-33317?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33317: OP-TEE out-of-bounds read and write in PKCS#11 TA

CVE-2026-33317 · Severity: high · CVSS 8.7 · Published 2026-04-24

OP-TEE is a secure operating system used on Arm-based devices to protect sensitive data like cryptographic keys. A vulnerability in its PKCS#11 component allows a malicious local application to bypass security boundaries and read or corrupt sensitive information stored in the secure memory area. This could lead to the theft of secret keys, system crashes, or unauthorized access to protected data.

Quick answers

Is CVE-2026-33317 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33317 being exploited in the wild.
How severe is CVE-2026-33317?: High severity, with a CVSS score of 8.7, published 24 April 2026.
Which products and versions are affected?: TrustedFirmware OP-TEE OS 3.13.0 through 4.10.0.
Is there a fix for CVE-2026-33317?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33317 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-33317?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the `entry_get_attribute_value()` function within `ta/pkcs11/src/object.c` of OP-TEE OS. The issue stems from missing bounds checks when processing template parameters via the `PKCS11_CMD_GET_ATTRIBUTE_VALUE` command. Specifically, the code fails to verify that the attribute head is fully within the template buffer and does not check for integer overflows in the length field. An attacker with local access can provide a malformed template to trigger an out-of-bounds read of up to 7 bytes or an out-of-bounds write into the TA heap. This can result in the disclosure of sensitive heap data, such as previously used secret keys, or memory corruption leading to a crash. Patches have been developed in commits e031c4e, 16926d5, and 149e8d7, with a formal fix expected in version 4.11.0.

Affected products

TrustedFirmware OP-TEE OS 3.13.0 through 4.10.0

Timeline

2025-12-23: other: Report received by vendor
2026-01-08: other: Issue and severity confirmed
2026-04-23: advisory: GitHub Security Advisory published
2026-04-24: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.