CVE-2026-45614
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
OP-TEE before version 4.11.0 does not verify that an ECDH public key lies on the correct curve. An attacker in the normal world can send about 30-40 crafted public keys to reconstruct the private key.
Risk Assessment
Exposure of the ECDH private key allows an attacker to impersonate the Trusted Execution Environment (TEE) and intercept sensitive data.
Recommendation
Immediately upgrade OP-TEE to version 4.11.0 or later, which includes the fix for curve point validation.
Other vulnerabilities in OP-TEE
See all- CVE-2026-53763Low
A 32-bit integer overflow vulnerability exists in the AES-GCM implementation of the OP-TEE core. After processing more than 512 megabytes of payload or Additional Authenticated Data (AAD), the authentication tag is computed with incorrect bit-length values.
- CVE-2026-44362Medium
In OP-TEE from version 3.20.0 to 4.10.0, a vulnerability exists in the subkey rollback protection mechanism. The `shdr_load_pub_key()` function fails to assign the subkey version to the runtime structure, leaving the version field at zero. Consequently, the version update check (`check_update_version()`) does not record the correct version, allowing Trusted Applications (TAs) signed with older or revoked subkeys to load successfully.
- CVE-2026-42546Low
In OP-TEE from version 3.3.0 to 4.10.0, a resource leak exists in the `cleanup_shm_refs()` function due to missing bitmask application on parameter attributes. This skips the `mobj_put()` call for non-contiguous memory parameters, causing a persistent leak of `mobj_reg_shm` objects and exhaustion of the secure-world heap.
- CVE-2026-41516Low
The RSA PKCS#1 v1.5 implementation in the Hisilicon HPRE crypto driver in OP-TEE is vulnerable to a Bleichenbacher-style attack. Non-constant-time `memcmp()` and distinguishable error paths allow an attacker to recover plaintext.
- CVE-2026-41515Low
The RSA-OAEP decryption in the NXP CAAM crypto driver for OP-TEE (versions 3.9.0 to 4.10.0) uses non-constant-time `memcmp()` for label hash verification and has distinguishable error paths. This allows an attacker to recover RSA-OAEP plaintext with approximately 1000-2000 adaptive chosen ciphertext queries via a Manger-style padding oracle.
- CVE-2026-41514Low
The RSA-OAEP implementation in the Hisilicon HPRE crypto driver in OP-TEE is vulnerable to a padding oracle attack. Non-constant-time memcmp() for label hash verification and distinguishable error paths allow plaintext recovery with approximately 1000-2000 adaptive chosen ciphertext queries.
- CVE-2026-41434Low
In OP-TEE from version 3.10.0 to 4.10.0, an unbounded recursion vulnerability in the PKCS#11 TA can cause a system crash. The issue is fixed in version 4.11.0.
- CVE-2026-40257Medium
An off-by-one error in the ARM Crypto Extensions accelerated SHA-3 implementation in OP-TEE can cause a massive heap overflow, corrupting all TEE kernel memory after the hash state. Affected versions are from 3.21.0 to 4.11.0 with `CFG_CRYPTO_WITH_CE82=y`.
- CVE-2026-45702Medium
A type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world, affecting versions 4.3.0 through 4.11.0. This only applies when configured as an SPMC for S-EL0 SPs.
- CVE-2026-40290High
In OP-TEE versions 3.16.0 through 4.10.0, a use-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A SPMC/SP flows, where a thread calling sp_mem_remove() without a lock can free objects while another thread dereferences them.
Original NVD description (English source)
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Prior to version 4.11.0, on many of the ECDH shared secret paths, the public key isn't verified to be a point on the correct curve. By passing approximately 30-40 crafted public keys to OP-TEE, the private key can be reconstructed by a normal world attacker. When calling TEE_DeriveKey the public key is provided with full X and Y values, but the (X, Y) point might not satisfy the `Y^2 == X^3 + aX + b mod P` math for the specific curve that is used. When those public keys aren't rejected, the attacker can select public keys such that each DeriveKey call will leak `d % r` where `d` is the private key and `r` comes from the relationship between the correct curve and the attacker selected curve. With enough leaked data the Chinese remainder theorem can be used to recover the full private key. Version 4.11.0 fixes the issue.