CVE-2026-53763
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A 32-bit integer overflow vulnerability exists in the AES-GCM implementation of the OP-TEE core. After processing more than 512 megabytes of payload or Additional Authenticated Data (AAD), the authentication tag is computed with incorrect bit-length values.
Risk Assessment
The organization may face integrity breaches of authenticated data within the TEE environment, potentially leading to unauthorized access or manipulation of data protected by TrustZone hardware security.
Recommendation
Upgrade OP-TEE to version 4.11.0 or later, which contains the fix. No known workarounds are available.
Original NVD description (English source)
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.0.0 and prior to version 4.11.0, 32-bit integer overflows in OP-TEE core's AES-GCM implementation cause the authentication tag to be computed with incorrect bit-length values after processing more than 512 megabytes of payload or Additional Authenticated Data (AAD). Version 4.11.0 contains a patch. No known workarounds are available.