Medium 5.5Published Aug 10, 2026

CVE-2026-71967OP-TEE OS 4.10.0 NULL Pointer Dereference DoS via Widevine PTA open_session

Updated under an hour ago (2026-10-19 07:23 UTC)

Does this affect you?

It affects OP-TEE optee_os. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for OP-TEE optee_os

Exploited in the last 30 days

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA open_session handler that allows Normal World clients to cause a denial of service when CFG_WIDEVINE_PTA is enabled. Attackers can open a session directly on the Widevine PTA to trigger an unconditional dereference of a NULL calling session pointer via is_user_ta_ctx(), faulting the TEE at S-EL1 and crashing the trusted execution environment.

CVSS: 5.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Awaiting Analysis
Record last updated: Aug 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

OP-TEE optee_os op_tee:optee_os (from the name)	through 4.10.0; 0aadfc23407f50e770eb5ddd871fc208f5626833 not affected	CNA record

References

https://github.com/OP-TEE/optee_os/pull/7899issue-tracking
https://github.com/OP-TEE/optee_os/commit/0aadfc23407f50e770eb5ddd871fc208f5626833patch
https://www.vulncheck.com/advisories/op-tee-os-null-pointer-dereference-dos-via-widevine-pta-open-sessionthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.