CVE-2026-41434: OP-TEE has unbounded recursion in sanitize_client_object()
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS#11 TA. Version 4.11.0 contains a patch. No known workarounds are available.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41434?
CVE-2026-41434 has a severity rating of low, with a score of 3.3.
How do I fix CVE-2026-41434?
To mitigate CVE-2026-41434, upgrade OP-TEE to version 4.11.0 or later where the vulnerability is patched.
What impact does CVE-2026-41434 have on system performance?
CVE-2026-41434 can cause the PKCS#11 Trusted Application to crash due to unbounded recursion, which may impact system performance.
Which versions of OP-TEE are affected by CVE-2026-41434?
CVE-2026-41434 affects OP-TEE versions 3.10.0 through 4.10.0.
What is the nature of the vulnerability in CVE-2026-41434?
CVE-2026-41434 is characterized by unbounded recursion in the sanitize_client_object() function within OP-TEE.