CVE-2026-41434

LowCVSS 3.3/10Last modified Jul 7, 2026

Description

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS#11 TA. Version 4.11.0 contains a patch. No known workarounds are available.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Jul 6, 2026
Last modified: Jul 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-414458.8KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allo CVE-2026-414469.8Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the CVE-2026-414477.8FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing CVE-2026-414489.4AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to CVE-2026-414497.8UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allo CVE-2026-41457.8During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticat CVE-2026-414507.8UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function whe CVE-2026-414517.8UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within CVE-2026-414529.8Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to CVE-2026-414538.8Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access CVE-2026-414548.3WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board membe CVE-2026-414558.5WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accept