CVE-2026-71967CWE-476

CVE-2026-71967

Medium · published August 10, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA open_session handler that allows Normal World clients to cause a denial of service when CFG_WIDEVINE_PTA is enabled. Attackers can open a session directly on the Widevine PTA to trigger an unconditional dereference of a NULL calling session pointer via is_user_ta_ctx(), faulting the TEE at S-EL1 and crashing the trusted execution environment.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.0th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-08-10T23:17Z
References (3)
https://github.com/OP-TEE/optee_os/commit/0aadfc23407f50e770eb5ddd871fc208f5626833 · [email protected]https://github.com/OP-TEE/optee_os/pull/7899 · [email protected]https://www.vulncheck.com/advisories/op-tee-os-null-pointer-dereference-dos-via-widevine-pta-open-session · [email protected]
EPSS history
Timeline
  • 10 AUG 18:11Z
    OP-TEE OS 4.10.0 NULL Pointer Dereference DoS via Widevine PTA open_session
    cvelistv5