Junglewise Threat Intelligence

CVE-2026-33317: OP-TEE out-of-bounds read and write in PKCS#11 TA

CVE-2026-33317 · Severity: high · CVSS 8.7 · Published 2026-04-24

Vendors: TrustedFirmware.

Executive brief

OP-TEE is a secure operating system used on Arm-based devices to protect sensitive data like cryptographic keys. A vulnerability in its PKCS#11 component allows a malicious local application to bypass security boundaries and read or corrupt sensitive information stored in the secure memory area. This could lead to the theft of secret keys, system crashes, or unauthorized access to protected data.

Technical details

A vulnerability exists in the `entry_get_attribute_value()` function within `ta/pkcs11/src/object.c` of OP-TEE OS. The issue stems from missing bounds checks when processing template parameters via the `PKCS11_CMD_GET_ATTRIBUTE_VALUE` command. Specifically, the code fails to verify that the attribute head is fully within the template buffer and does not check for integer overflows in the length field. An attacker with local access can provide a malformed template to trigger an out-of-bounds read of up to 7 bytes or an out-of-bounds write into the TA heap. This can result in the disclosure of sensitive heap data, such as previously used secret keys, or memory corruption leading to a crash. Patches have been developed in commits e031c4e, 16926d5, and 149e8d7, with a formal fix expected in version 4.11.0.

Affected products

  • TrustedFirmware OP-TEE OS 3.13.0 through 4.10.0

Timeline

  • 2025-12-23: other: Report received by vendor
  • 2026-01-08: other: Issue and severity confirmed
  • 2026-04-23: advisory: GitHub Security Advisory published
  • 2026-04-24: disclosed: NVD publication date

References