{"id":"CVE-2026-33317","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-33317","generatedAt":"2026-10-28T02:23:13.880Z","title":"OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology.","description":"OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()`  in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE`  or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.","published":"2026-04-24T03:16:11.000Z","lastModified":"2026-10-26T21:10:00.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":8.7,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L"},"cwe":["CWE-125","CWE-787"],"affected":["trustedfirmware/op-tee"],"epss":{"score":0.00185,"percentile":0.08033,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/OP-TEE/optee_os/commit/149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/OP-TEE/optee_os/commit/16926d5a46934c46e6656246b4fc18385a246900","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/OP-TEE/optee_os/commit/e031c4e562023fd9f199e39fd2e85797e4cbdca9","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/OP-TEE/optee_os/security/advisories/GHSA-8cqw-mg7v-c9p9","tags":["Exploit","Patch","Vendor Advisory"],"source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-33317","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}