PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33317 OP-TEE CVE debrief

A high-severity vulnerability in OP-TEE, a Trusted Execution Environment (TEE) for Arm Cortex-A cores, allows for out-of-bounds read and write operations. This vulnerability, tracked as CVE-2026-33317, affects OP-TEE versions 3.13.0 through 4.10.0 and has a CVSS score of 8.7. The vulnerability is caused by missing checks in the `entry_get_attribute_value()` function in `ta/pkcs11/src/object.c`, which can lead to out-of-bounds reads from the PKCS#11 TA heap or crashes. When chained with the out-of-bounds read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE` or `entry_get_attribute_value()` can be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object.

Vendor
OP-TEE
Product
optee_os
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-24
Original CVE updated
2026-06-05
Advisory published
2026-04-24
Advisory updated
2026-06-05

Who should care

Users of OP-TEE versions 3.13.0 through 4.10.0 should apply patches to mitigate this vulnerability. The patches are anticipated to be part of version 4.11.0 and are available in commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca.

Technical summary

The vulnerability is caused by missing checks in the `entry_get_attribute_value()` function in `ta/pkcs11/src/object.c`. This allows for out-of-bounds reads from the PKCS#11 TA heap or crashes. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L.

Defensive priority

high

Recommended defensive actions

  • Apply patches from commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca.
  • Upgrade to OP-TEE version 4.11.0 or later.

Evidence notes

The CVE record and details can be found at [cve-org]. The NVD detail page is available at [nvd]. Additional information and patches can be found at [ref-4], [ref-5], [ref-6], and [ref-7].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33317 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33317

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33317 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33317

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.