CVE-2026-71967
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
OP-TEE OS through 4.10.0 contains a null pointer dereference vulnerability in the Widevine pseudo-TA open_session handler when CFG_WIDEVINE_PTA is enabled. Attackers can open a session directly on the Widevine PTA to trigger an unconditional dereference of a NULL calling session pointer, faulting the TEE at S-EL1 and crashing the trusted execution environment.
Risk Assessment
The vulnerability allows an attacker from the Normal World to crash the trusted execution environment (TEE), leading to denial of service for critical services relying on OP-TEE.
Recommendation
Apply the fix available in commit 0aadfc2 or upgrade OP-TEE OS to a patched version. If possible, disable CFG_WIDEVINE_PTA if not required.
Original NVD description (English source)
OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA open_session handler that allows Normal World clients to cause a denial of service when CFG_WIDEVINE_PTA is enabled. Attackers can open a session directly on the Widevine PTA to trigger an unconditional dereference of a NULL calling session pointer via is_user_ta_ctx(), faulting the TEE at S-EL1 and crashing the trusted execution environment.