Out-of-Bounds Read Vulnerability in OP-TEE Trusted Execution Environment
CVE-2026-33317
8.7HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-33317?
A vulnerability exists in OP-TEE, specifically in the entry_get_attribute_value() function, which lacks proper validation checks. This issue affects versions from 3.13.0 to 4.10.0, leading to potential out-of-bounds reads from the PKCS#11 TA heap. An attacker might exploit this flaw by manipulating template parameters, enabling unauthorized reading or writing of data beyond allocated buffers. This can result in application crashes or unexpected behavior, compromising the security integrity of systems utilizing OP-TEE.
Affected Version(s)
optee_os >= 3.13.0, <= 4.10.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.