CVE-2026-71969

Received Received - Intake

Buffer Underwrite in OP-TEE OS via RSA NOPAD Operations

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description

OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver that allows a malicious Trusted Application to corrupt secure-world heap memory by supplying an input length exceeding the RSA modulus size. When src_len exceeds rsa_len, the subtraction expression wraps to a large unsigned value, causing a subsequent memcpy to write attacker-controlled data before the destination buffer in S-EL1 secure-world heap memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-71969

EUVD

EUVD-2026-55699

Affected Vendors & Products

Vendor	Product	Version / Range
mbedtls	mbedtls	to 4.10.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-124	The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a buffer underwrite issue in OP-TEE OS through 4.10.0 affecting RSA NOPAD encrypt and decrypt operations in the mbedTLS backend and SE050 hardware driver. A malicious Trusted Application can exploit it by providing an input length exceeding the RSA modulus size, causing heap memory corruption in the secure-world.

Detection Guidance

This vulnerability requires checking for buffer underwrite conditions in RSA NOPAD operations within OP-TEE OS or mbedTLS. No direct detection commands are provided in the context. Review OP-TEE OS versions for updates and inspect Trusted Application code for improper input length handling in RSA operations.

Impact Analysis

An attacker could exploit this to corrupt secure-world heap memory, potentially leading to unauthorized data access, privilege escalation, or denial of service in systems using OP-TEE OS with vulnerable mbedTLS or SE050 components.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized memory corruption in secure-world heap memory. If exploited, it may lead to data breaches or unauthorized access to sensitive data, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Update OP-TEE OS to a version that includes commit 7b8b494 or later to fix the buffer underwrite vulnerability in RSA operations.

Hi! I’m here to help you understand CVE-2026-71969. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70