CVE-2026-33662 Details
Description
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. From 3.8.0 to 4.10, in the function emsa_pkcs1_v1_5_encode() in core/drivers/crypto/crypto_api/acipher/rsassa.c, the amount of padding needed, "PS size", is calculated by subtracting the size of the digest and other fields required for the EMA-PKCS1-v1_5 encoding from the size of the modulus of the key. By selecting a small enough modulus, this subtraction can overflow. The padding is added as a string of 0xFF bytes with a call to memset(), and an underflowed integer will cause the memset() call to overwrite until OP-TEE crashes. This only affects platforms registering RSA acceleration.
A vulnerability exists in OP-TEE versions 3.8.0 prior to 4.10 within the RSA signature scheme padding process. The issue arises in the 'emsa_pkcs1_v1_5_encode()' function, where the required padding size is calculated by subtracting the digest size and other fields from the key modulus size. This calculation can be manipulated to overflow by using a small modulus, leading to an integer underflow. The resulting underflowed value causes a heap buffer overflow with 0xFF bytes, overwriting memory until OP-TEE crashes. This vulnerability affects platforms with registered RSA acceleration, such as those using CAAM, certain Hisilicon and Versal configurations, and NXP SE050 under specific conditions.
Users can upgrade to OP-TEE version 4.11 or later to address this vulnerability. Alternatively, disabling RSA acceleration will prevent the issue, but this may not be suitable for all users.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OP-TEE/optee_os/security/advisories/GHSA-4cf8-v5g3-73gr | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| trustedfirmware op-tee | >= 3.8.0, <= 4.10.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | Reanalysis | [email protected] |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 24, 2026 | New CVE Received | [email protected] |