{
  "affected": [
    {
      "affectedData": [
        {
          "product": "optee_os",
          "vendor": "OP-TEE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.8.0, \u003c= 4.10"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF89E0A3-1EAB-4954-8F4C-3AA14C015E5E",
              "versionEndIncluding": "4.10.0",
              "versionStartIncluding": "3.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. From 3.8.0 to 4.10, in the function emsa_pkcs1_v1_5_encode() in core/drivers/crypto/crypto_api/acipher/rsassa.c, the amount of padding needed, \"PS size\", is calculated by subtracting the size of the digest and other fields required for the EMA-PKCS1-v1_5 encoding from the size of the modulus of the key. By selecting a small enough modulus, this subtraction can overflow. The padding is added as a string of 0xFF bytes with a call to memset(), and an underflowed integer will cause the memset() call to overwrite until OP-TEE crashes. This only affects platforms registering RSA acceleration."
    },
    {
      "lang": "es",
      "value": "OP-TEE es un Entorno de Ejecuci\u00f3n Confiable (TEE) dise\u00f1ado como compa\u00f1ero de un kernel de Linux no seguro ejecut\u00e1ndose en n\u00facleos Arm Cortex-A que utilizan la tecnolog\u00eda TrustZone. Desde la versi\u00f3n 3.8.0 hasta la 4.10, en la funci\u00f3n emsa_pkcs1_v1_5_encode() en core/drivers/crypto/crypto_api/acipher/rsassa.c, la cantidad de relleno necesaria, \u2019tama\u00f1o PS\u2019, se calcula restando el tama\u00f1o del digest y otros campos requeridos para la codificaci\u00f3n EMA-PKCS1-v1_5 del tama\u00f1o del m\u00f3dulo de la clave. Al seleccionar un m\u00f3dulo lo suficientemente peque\u00f1o, esta resta puede desbordarse. El relleno se a\u00f1ade como una cadena de bytes 0xFF con una llamada a memset(), y un entero desbordado por debajo har\u00e1 que la llamada a memset() sobrescriba hasta que OP-TEE falle. Esto solo afecta a las plataformas que registran aceleraci\u00f3n RSA."
    }
  ],
  "id": "CVE-2026-33662",
  "lastModified": "2026-10-26T22:10:00.163",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33662",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-24T19:00:09.301248Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-24T19:17:09.997",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/OP-TEE/optee_os/security/advisories/GHSA-4cf8-v5g3-73gr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}