optee_os vulnerabilities

5 known vulnerabilities in optee_os from OP-TEE. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  optee_os: Use After Free

  CVE-2026-40290Jun 3, 2026OP-TEE

  OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.16.0 and prior to 4.11.0, a user-after-free (UAF) race condition exists in t

• 7.5 High severity

  optee_os: Integer Overflow or Wraparound

  CVE-2026-33662Apr 24, 2026OP-TEE

  OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. From 3.8.0 to 4.10, in the function emsa_pkcs1_v1_5_encode() in core/drivers/crypto/crypto_api/aci

• 8.7 High severity

  optee_os: Out-of-bounds Read

  CVE-2026-33317Apr 24, 2026OP-TEE

  OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()` in `ta/pkcs11/s

• 7.9 High severity

  optee_os: Improper Handling of Exceptional Conditions

  CVE-2025-46733Jul 4, 2025OP-TEE

  OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In version 4.5.0, using a specially crafted tee-supplicant binary running in REE userspace, an att

• 8.8 High severity

  optee_os: Improper Validation of Array Index

  CVE-2022-46152Nov 29, 2022OP-TEE

  OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_com