CVE-2026-71969

Name of the Vulnerable Software and Affected Versions OP-TEE OS versions prior to 4.10.0 commit 7b8b494

Description A buffer underwrite issue exists in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver. A malicious Trusted Application can corrupt secure-world heap memory by providing an input length that exceeds the RSA modulus size. Specifically, when the src len variable exceeds rsa len, the subtraction expression wraps to a large unsigned value, leading a memcpy() function to write attacker-controlled data before the destination buffer in S-EL1 secure-world heap memory.

Recommendations Update OP-TEE OS to the version containing commit 7b8b494.