PT-2026-34837 · Op Tee · Op-Tee

Etienne Carriere · Published 2026-04-24 · Updated 2026-04-25 · CVE-2026-33317

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OP-TEE versions 3.13.0 through 4.10.0

Description Missing checks in the entry get attribute value() function within ta/pkcs11/src/object.c can result in a crash or an out-of-bounds read from the PKCS#11 TA heap. If combined with an out-of-bounds read, the entry get attribute value() function or the PKCS#11 TA function PKCS11 CMD GET ATTRIBUTE VALUE can be manipulated using a malicious template parameter to read up to 7 bytes beyond the template buffer end and write attribute value content beyond the template buffer end.

Recommendations Update to version 4.11.0.

Exploit

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

CVE-2026-33317

Affected Products

Op-Tee

References · 11

• 🔥 https://github.com/OP-TEE/optee_os/security/advisories/GHSA-8cqw-mg7v-c9p9 · Exploit
• https://github.com/OP-TEE/optee_os/commit/149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca · Patch
• https://github.com/OP-TEE/optee_os/commit/16926d5a46934c46e6656246b4fc18385a246900 · Patch
• https://github.com/OP-TEE/optee_os/commit/e031c4e562023fd9f199e39fd2e85797e4cbdca9 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-33317 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33317 · Security Note
• https://ubuntu.com/security/CVE-2026-33317 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33317 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33317 · Vendor Advisory
• https://twitter.com/CVEnew/status/2048099332553924651 · Twitter Post