Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-33317

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()` in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE` or `entry_get_attribute_value()` can, with a bad template parameter,
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:078cee0ac25a146b3f7d47460ed8842b9095afc0c892007bb3f8087a297d0021
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-787","description":"CWE-787: Out-of-bounds Write","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:e82aa386d0dc7385b117e50bb4458152c02ad0ef077f7a0d2a1712636793bcbc · sha256:6b9f5697c1468beb… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-125","description":"CWE-125: Out-of-bounds Read","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:e82aa386d0dc7385b117e50bb4458152c02ad0ef077f7a0d2a1712636793bcbc · sha256:6b9f5697c1468beb… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"product":"optee_os","vendor":"OP-TEE","versions":[{"status":"affected","version":">= 3.13.0, <= 4.10.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e82aa386d0dc7385b117e50bb4458152c02ad0ef077f7a0d2a1712636793bcbc · sha256:6b9f5697c1468beb… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:e82aa386d0dc7385b117e50bb4458152c02ad0ef077f7a0d2a1712636793bcbc · sha256:6b9f5697c1468beb… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-787","description":"CWE-787: Out-of-bounds Write","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:e82aa386d0dc7385b117e50bb4458152c02ad0ef077f7a0d2a1712636793bcbc · sha256:6b9f5697c1468beb… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-125","description":"CWE-125: Out-of-bounds Read","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:e82aa386d0dc7385b117e50bb4458152c02ad0ef077f7a0d2a1712636793bcbc · sha256:6b9f5697c1468beb… · /containers/cna/problemTypes/0/descriptions/0

Source references

4 source assertions
{"name":"https://github.com/OP-TEE/optee_os/commit/149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca","tags":["x_refsource_MISC"],"url":"https://github.com/OP-TEE/optee_os/commit/149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e82aa386d0dc7385b117e50bb4458152c02ad0ef077f7a0d2a1712636793bcbc · sha256:6b9f5697c1468beb… · /containers/cna/references/1
{"name":"https://github.com/OP-TEE/optee_os/commit/16926d5a46934c46e6656246b4fc18385a246900","tags":["x_refsource_MISC"],"url":"https://github.com/OP-TEE/optee_os/commit/16926d5a46934c46e6656246b4fc18385a246900"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e82aa386d0dc7385b117e50bb4458152c02ad0ef077f7a0d2a1712636793bcbc · sha256:6b9f5697c1468beb… · /containers/cna/references/2
{"name":"https://github.com/OP-TEE/optee_os/commit/e031c4e562023fd9f199e39fd2e85797e4cbdca9","tags":["x_refsource_MISC"],"url":"https://github.com/OP-TEE/optee_os/commit/e031c4e562023fd9f199e39fd2e85797e4cbdca9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e82aa386d0dc7385b117e50bb4458152c02ad0ef077f7a0d2a1712636793bcbc · sha256:6b9f5697c1468beb… · /containers/cna/references/3
{"name":"https://github.com/OP-TEE/optee_os/security/advisories/GHSA-8cqw-mg7v-c9p9","tags":["x_refsource_CONFIRM"],"url":"https://github.com/OP-TEE/optee_os/security/advisories/GHSA-8cqw-mg7v-c9p9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e82aa386d0dc7385b117e50bb4458152c02ad0ef077f7a0d2a1712636793bcbc · sha256:6b9f5697c1468beb… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer