CVE-2026-71967: OP-TEE OS 4.10.0 NULL Pointer Dereference DoS via Widevine PTA open_session
OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA opensession handler that allows Normal World clients to cause a denial of service when CFGWIDEVINEPTA is enabled. Attackers can open a session directly on the Widevine PTA to trigger an unconditional dereference of a NULL calling session pointer via isusertactx(), faulting the TEE at S-EL1 and crashing the trusted execution environment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OP-TEE OSto a version that resolves this vulnerability.Patch commit 0aadfc2 - Configuration
If you are running OP-TEE OS through 4.10.0 and cannot immediately apply commit 0aadfc2, disable CFG_WIDEVINE_PTA to prevent Normal World clients from reaching the Widevine PTA open_session NULL pointer dereference (DoS) vulnerability.
OP-TEE OS (CFG_WIDEVINE_PTA) CFG_WIDEVINE_PTA = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71967?
CVE-2026-71967 has a medium severity rating of 5.5.
How do I fix CVE-2026-71967?
To fix CVE-2026-71967, update OP-TEE OS to version 4.10.0 or later where the vulnerability is addressed.
What type of vulnerability is documented in CVE-2026-71967?
CVE-2026-71967 is a null pointer dereference vulnerability.
What effect does CVE-2026-71967 have on systems?
CVE-2026-71967 can cause a denial of service when the Widevine pseudo-TA open_session handler is exploited.
What component of OP-TEE OS is affected by CVE-2026-71967?
CVE-2026-71967 affects the Widevine pseudo-TA open_session handler in OP-TEE OS.