CVE-2026-41434

LowCVSS 3.3

Published: 06/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

In OP-TEE from version 3.10.0 to 4.10.0, an unbounded recursion vulnerability in the PKCS#11 TA can cause a system crash. The issue is fixed in version 4.11.0.

Risk Assessment

An attacker could exploit this vulnerability to crash the Trusted Execution Environment (TEE), disrupting security services and potentially compromising system integrity.

Recommendation

Immediately upgrade OP-TEE to version 4.11.0 or later. No workarounds are available.

Original NVD description (English source)

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS#11 TA. Version 4.11.0 contains a patch. No known workarounds are available.