Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2026-33317 EUVD-2026-25379

OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure

Published Apr 24, 2026 · Updated Apr 24, 2026 · Assigned by GitHub_M

Description

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()` in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE` or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.

Affected products

VendorProductAffectedFixed
OP-TEE optee_os >= 3.13.0, <= 4.10.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 optee-os No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 optee-os No fix yet —
Ubuntu 26.04 LTS optee-os No fix yet —
Ubuntu 25.10 optee-os No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • 0xbbdd/CVE-2026-33317 ★ 0 · Apr 30, 2026

    PoC for CVE-2026-33317 OP-TEE PKCS#11 TA out-of-bounds write

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References