Vulnerability in OP-TEE (CVE-2026-45614)
Summary
Vulnerability in OP-TEE (CVE-2026-45614). Confidential information can be exposed externally.
Original description
The description as published by the source.
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Prior to version 4.11.0, on many of the ECDH shared secret paths, the public key isn't verified to be a point on the correct curve. By passing approximately 30-40 crafted public keys to OP-TEE, the private key can be reconstructed by a normal world attacker. When calling TEE_DeriveKey the public key is provided with full X and Y values, but the (X, Y) point might not satisfy the Y^2 == X^3 + aX + b mod P math for the specific curve that is used. When those public keys aren't rejected, the attacker can select public keys such that each DeriveKey call will leak d % r where d is the private key and r comes from the relationship between the correct curve and the attacker selected curve. With enough leaked data the Chinese remainder theorem can be used to recover the full private key. Version 4.11.0 fixes the issue.
Source: NIST National Vulnerability Database NVD
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-45614 has been found in OP-TEE.
Confidential information can be exposed externally. CVSS score: 4.7/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "OP-TEE CVE-2026-45614" on the vendor's site.
CVE-2026-45614 (OP-TEE) — CWE-347 / CVSS v3 4.7
Attack vector: local / no user interaction
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-347) exists in OP-TEE.
Check the vendor advisory for the affected versions of OP-TEE.
Severity: Medium (CVSS 4.7/10). Confidential information can be exposed externally.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'OP-TEE' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'OP-TEE' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
OP-TEEを grep し、稼働しているサービス・バージョンを把握する。 -
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-45614 optee-os
- Ubuntu UBUNTU-CVE-2026-45614 optee-os
References
- exploit github.com