CVE-2026-71969: OP-TEE OS Buffer Overflow Vulnerability

CVE-2026-71969 Overview

CVE-2026-71969 is a buffer underwrite vulnerability in OP-TEE OS through version 4.10.0, affecting the RSA NOPAD encrypt and decrypt operations. The flaw resides in the mbedTLS software backend and the SE050 hardware driver. A malicious Trusted Application (TA) can corrupt secure-world heap memory by supplying an input length that exceeds the RSA modulus size. When src_len exceeds rsa_len, the subtraction expression wraps to a large unsigned value, causing a subsequent memcpy to write attacker-controlled data before the destination buffer in S-EL1 secure-world heap memory. The issue is tracked as [CWE-124] Buffer Underwrite and was fixed in commit 7b8b494.

Critical Impact
A malicious Trusted Application can corrupt S-EL1 secure-world heap memory, undermining the confidentiality and integrity guarantees of the Trusted Execution Environment.

Affected Products

OP-TEE OS versions through 4.10.0
mbedTLS software cryptographic backend within OP-TEE
SE050 secure element hardware driver within OP-TEE

Discovery Timeline

2026-08-10 - CVE-2026-71969 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71969

Vulnerability Analysis

OP-TEE OS is an open-source Trusted Execution Environment (TEE) implementation compatible with the Arm TrustZone architecture. Trusted Applications run in the secure world (S-EL0) and invoke cryptographic primitives handled by the OP-TEE kernel at S-EL1. The vulnerable functions crypto_acipher_rsanopad_encrypt() and crypto_acipher_rsanopad_decrypt() in core/drivers/crypto/crypto_api/acipher/rsa.c fail to validate that the caller-supplied input length does not exceed the RSA modulus size. This omission allows a TA operating with legitimate access to RSA primitives to trigger heap corruption in the secure kernel context.

Root Cause

The root cause is missing bounds validation on src_len relative to the RSA key modulus size (rsa_len or key.n_size). When src_len > rsa_len, the expression rsa_len - src_len performed on unsigned integers wraps to an enormous value. This wrapped value is then used as the memcpy length argument, writing attacker-controlled bytes to memory positioned before the intended destination buffer. The primitive corresponds to [CWE-124] Buffer Underwrite.

Attack Vector

Exploitation requires local access with the ability to load and execute a Trusted Application inside the TEE. The malicious TA calls the RSA NOPAD encrypt or decrypt primitive with a source length larger than the modulus size. Because writes land in S-EL1 heap memory, a successful attacker can corrupt secure-world kernel structures adjacent to the destination buffer, compromising the isolation boundary the TEE is designed to enforce.

 	rsa_data.key.key = key;
 	rsa_data.key.isprivate = true;
 	rsa_data.key.n_size = crypto_bignum_num_bytes(key->n);
+	if (cipher_len > rsa_data.key.n_size)
+		return TEE_ERROR_BAD_PARAMETERS;
 
 	rsa = drvcrypt_get_ops(CRYPTO_RSA);
 	if (rsa) {

Source: OP-TEE commit 7b8b494. The patch adds a cipher_len > rsa_data.key.n_size bounds check that returns TEE_ERROR_BAD_PARAMETERS before any memcpy executes.

Detection Methods for CVE-2026-71969

Indicators of Compromise

Trusted Applications invoking TEE_AsymmetricEncrypt or TEE_AsymmetricDecrypt with TEE_ALG_RSA_NOPAD and input buffer lengths larger than the RSA key modulus.
Secure-world panics, unexpected TEE_ERROR_GENERIC returns, or kernel aborts following RSA NOPAD operations.
Unsigned or unexpected TA binaries present in the TA storage partition of embedded devices.

Detection Strategies

Audit deployed OP-TEE builds and confirm whether they include the fix from commit 7b8b494 or pull requests #7808 and #7898.
Enable OP-TEE debug logging and monitor for anomalous parameters passed to crypto_acipher_rsanopad_encrypt() and crypto_acipher_rsanopad_decrypt().
Perform static analysis of in-house Trusted Applications for RSA NOPAD calls that do not clamp src_len to the modulus size before invocation.

Monitoring Recommendations

Track OP-TEE kernel logs on production devices for secure-world faults correlated with RSA operations.
Maintain an inventory of firmware versions and OP-TEE commit hashes across your device fleet to identify unpatched builds.
Verify TA signing policy enforcement so that only vetted Trusted Applications can be loaded into the secure world.

How to Mitigate CVE-2026-71969

Immediate Actions Required

Update OP-TEE OS to a build that includes commit 7b8b494 or later, which rejects oversized RSA NOPAD inputs with TEE_ERROR_BAD_PARAMETERS.
Rebuild and redeploy firmware images for any product line shipping OP-TEE 4.10.0 or earlier.
Restrict which Trusted Applications may be loaded by enforcing signature verification and removing unused or third-party TAs.

Patch Information

The upstream fix is available in the OP-TEE OS repository as commit 7b8b494e0a324cefec8ed386b7de413b44f1aaf3, delivered through pull requests #7808 and #7898. Additional detail is provided in the VulnCheck advisory. Vendors integrating OP-TEE into shipping products must cherry-pick or rebase to a fixed revision.

Workarounds

In Trusted Application code, validate that the RSA NOPAD input length is less than or equal to the key modulus size before invoking the primitive.
Prefer padded RSA schemes such as TEE_ALG_RSAES_PKCS1_V1_5 or OAEP variants that already enforce length constraints.
Disable or remove the SE050 driver path if the secure element is not required by the product configuration.

bash

# Verify the OP-TEE tree contains the fix before building firmware
git -C optee_os log --oneline | grep 7b8b494 \
  || echo "WARNING: OP-TEE build does not contain the CVE-2026-71969 fix"

# Cherry-pick the fix onto a maintained branch
git -C optee_os fetch origin
git -C optee_os cherry-pick 7b8b494e0a324cefec8ed386b7de413b44f1aaf3