PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41516 OP-TEE CVE debrief

CVE-2026-41516 is a Bleichenbacher-style padding oracle vulnerability in the OP-TEE Hisilicon HPRE crypto driver. The issue affects OP-TEE versions from 4.5.0 up to but not including 4.11.0. An attacker can exploit this vulnerability to recover RSA PKCS#1 v1.5 plaintext. This vulnerability has a CVSS score of 2.5 and is rated as LOW. Organizations using OP-TEE versions between 4.5.0 and 4.10.0 should prioritize patching.

Vendor
OP-TEE
Product
optee_os
CVSS
LOW 2.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-06
Original CVE updated
2026-07-07
Advisory published
2026-07-06
Advisory updated
2026-07-07

Who should care

Organizations using OP-TEE versions between 4.5.0 and 4.10.0 should prioritize patching. This vulnerability is rated as LOW with a CVSS score of 2.5. Security teams and operators of affected systems should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The OP-TEE Hisilicon HPRE crypto driver uses non-constant-time `memcmp()` for label hash verification and has multiple distinguishable error paths in its RSA PKCS#1 v1.5 decryption implementation. This creates a Bleichenbacher-style padding oracle that allows an attacker to recover RSA PKCS#1 v1.5 plaintext. The vulnerability was patched in OP-TEE version 4.11.0. Affected systems may have exposure to sensitive data.

Defensive priority

Apply patches or workarounds to disable the vulnerable driver. Prioritize patching for organizations using OP-TEE versions between 4.5.0 and 4.10.0.

Recommended defensive actions

  • Apply the patch in OP-TEE version 4.11.0 or later.
  • As a workaround, disable the Hisilicon HPRE RSA driver with `CFG_HISILICON_ACC_V3=n`.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record was published on 2026-07-06T20:16:32.197Z and was last modified on 2026-07-07T18:56:37.570Z. The NVD entry is currently Analyzed. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify the affected scope and vendor guidance with official sources.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-06T20:16:32.197Z and has not been modified since then. The NVD entry is currently Analyzed.