CVE-2026-71967

Received Received - Intake

Null Pointer Dereference in OP-TEE OS Widevine PTA

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA open_session handler that allows Normal World clients to cause a denial of service when CFG_WIDEVINE_PTA is enabled. Attackers can open a session directly on the Widevine PTA to trigger an unconditional dereference of a NULL calling session pointer via is_user_ta_ctx(), faulting the TEE at S-EL1 and crashing the trusted execution environment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-71967

EUVD

EUVD-2026-55696

Affected Vendors & Products

Vendor	Product	Version / Range
op-tee	op-tee_os	to 4.10.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a null pointer dereference flaw in OP-TEE OS through version 4.10.0. It occurs in the Widevine pseudo-TA open_session handler when CFG_WIDEVINE_PTA is enabled. Attackers can exploit this by opening a session directly on the Widevine PTA, causing the system to dereference a NULL pointer and crash the trusted execution environment at S-EL1.

Detection Guidance

Detection requires checking if OP-TEE OS is running with CFG_WIDEVINE_PTA enabled and if the Widevine pseudo-TA is accessible. Inspect OP-TEE logs for crashes or NULL pointer dereferences in the TEE. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows attackers with local access to cause a denial of service by crashing the trusted execution environment. This could disrupt services relying on OP-TEE OS, potentially leading to system instability or unavailability for affected operations.

Compliance Impact

This vulnerability causes a denial of service by crashing the trusted execution environment (TEE) at S-EL1, which could disrupt security-critical operations. For compliance with GDPR or HIPAA, such disruptions may lead to unauthorized access risks or data processing interruptions, potentially violating availability requirements under these regulations.

Mitigation Strategies

Apply the patch from commit 0aadfc2 or upgrade OP-TEE OS to a version beyond 4.10.0. Disable CFG_WIDEVINE_PTA if Widevine functionality is not required. Monitor for crashes in the TEE environment.

Hi! I’m here to help you understand CVE-2026-71967. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70