CVE-2026-71968: fallo de gravedad alta en OP-TEE optee_os
OP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA_FLAG_CONCURRENT
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.4epss 0.1%
OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TA_FLAG_CONCURRENT flag in a user TA signed header. Attackers can cause two concurrent sessions to operate on the same shared context without locking, corrupting the uctx->vm_info.regions list during memref parameter mapping and unmapping to free vm_region nodes still in use, resulting in a use-after-free in S-EL1 secure-world kernel memory.
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
OP-TEE · optee_osCVEs relacionadas — OP-TEE optee_os
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-46152HIGHOP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs functionEPSS 0.5%CVE-2026-33662HIGHOP-TEE: RSASSA EMSA- PKCS1-v1_5 underflow in emsa_pkcs1_v1_5_encode()EPSS 0.4%CVE-2023-41325HIGHOP-TEE double free in shdr_verify_signatureEPSS 0.4%CVE-2026-53763LOWOP-TEE has AES-GCM 32-bit integer overflow in length counters that breaks authentication guaranteeEPSS 0.2%CVE-2026-40290HIGHOP-TEE has a Use-After-Free race in FF-A shared-memory teardownEPSS 0.2%CVE-2026-33317HIGHOP-TEE: PKCS#11 TA out-of-bounds read and memory disclosureEPSS 0.2%