Is CVE-2026-45614 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45614 being exploited in the wild.

How severe is CVE-2026-45614?

Medium severity, with a CVSS score of 4.7, published 3 June 2026.

Is there a fix for CVE-2026-45614?

A patch was published on 2026-06-03: Fix published in version 4.11.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45614 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-45614?

Check whether you run Op-Tee Os at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45614: OP-TEE private key recovery via invalid curve points in ECDH

CVE-2026-45614 · Severity: medium · CVSS 4.7 · Published 2026-06-03

OP-TEE is a secure operating system used on Arm-based devices to protect sensitive data and cryptographic keys from the main Linux system. A vulnerability in how it handles certain cryptographic operations allows a local attacker to recover private encryption keys by providing specially crafted data. This could lead to the compromise of secure communications or protected data on affected mobile and embedded devices.

Technologies: Op-Tee Os. Vendors: Op-Tee.

Quick answers

Is CVE-2026-45614 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45614 being exploited in the wild.
How severe is CVE-2026-45614?: Medium severity, with a CVSS score of 4.7, published 3 June 2026.
Which products and versions are affected?: Op-Tee Os < 4.11.0.
Is there a fix for CVE-2026-45614?: A patch was published on 2026-06-03: Fix published in version 4.11.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45614 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-45614?: Check whether you run Op-Tee Os at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in OP-TEE's ECDH implementation where the TEE_DeriveKey function fails to validate that a provided public key (X, Y) resides on the intended elliptic curve. By submitting 30-40 crafted public keys that do not satisfy the curve equation, a 'normal world' attacker with local access can observe leaked residues of the private key. Using the Chinese Remainder Theorem, the attacker can reconstruct the full private ECC key. The issue affects implementations using libtomcrypt and CAAM drivers, while MbedTLS and certain hardware-backed implementations (like STM32) are reportedly unaffected. The vulnerability is addressed in version 4.11.0 by validating that ECC public keys are on the curve.

Affected products

OP-TEE OP-TEE OS < 4.11.0

Timeline

2026-04-22: disclosed: Report received by vendor
2026-04-24: other: Security issue and severity confirmed
2026-06-03: patched: Fix published in version 4.11.0
2026-06-03: advisory: Public disclosure of CVE-2026-45614

References

https://github.com/OP-TEE/optee_os/security/advisories/GHSA-g6qf-hwf7-mg9h

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.