Out-of-bounds Read in Op-Tee Optee OS
CVE-2026-33317
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()` in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE` or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.002 (8.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 8.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Op-Tee Optee OS — versions >= 3.13.0, <= 4.10.0
- Trustedfirmware Op-Tee
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/OP-TEE/optee_os/security/advisories/GHSA-8cqw-mg7v-c9p9 (Exploit, Patch, Vendor Advisory)
- github.com/OP-TEE/optee_os/commit/149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca (Patch)
- github.com/OP-TEE/optee_os/commit/16926d5a46934c46e6656246b4fc18385a246900 (Patch)
- github.com/OP-TEE/optee_os/commit/e031c4e562023fd9f199e39fd2e85797e4cbdca9 (Patch)
Frequently asked questions
- What is CVE-2026-33317?
- CVE-2026-33317 is a high-severity vulnerability in Op-Tee Optee OS, classified under Out-of-bounds Read. CVSS score: 8.7/10. Published 2026-04-24.
- How severe is CVE-2026-33317?
- High severity. CVSS v3 base score is 8.7 out of 10.
- Is CVE-2026-33317 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.