CVE-2026-40257: off-by-one — MEDIUM

CISO Take

OP-TEE, the open-source TrustZone Trusted Execution Environment shipped across ARM-based edge, mobile, and IoT silicon, has an off-by-one error in its hardware-accelerated SHA-3 implementation that triggers a massive heap overflow corrupting TEE kernel memory on any platform built with CFG_CRYPTO_WITH_CE82=y. For CISOs overseeing edge AI or embedded ML deployments this matters because OP-TEE is commonly the hardware root of trust protecting model weights, cryptographic keys, and secure boot chains on ARMv8.2+ NPUs and SoCs — a local, low-privileged attacker who can trigger the SHA-3 Crypto Extensions path (AV:L, PR:L, no user interaction required, CVSS 5.5) can crash or corrupt that trust anchor. EPSS sits at just 0.11%, there is no public exploit or Nuclei template, and it is not in CISA KEV, so this is not an imminent mass-exploitation risk, but the bug is trivially reachable once local access exists (low attack complexity, CWE-787 out-of-bounds write, twice-listed reflecting the underlying flaw's write primitive). Patch to OP-TEE 4.11.0, or apply the interim workaround of setting CFG_CRYPTO_WITH_CE82=n and rebuilding affected firmware while coordinating with SoC/OEM vendors on rollout to already-fielded devices.

Sources: NVD GitHub Advisory EPSS

What is the risk?

Medium severity by CVSS (5.5), but the context is a security-critical trust anchor: a heap overflow that corrupts all TEE kernel memory following the hash state is architecturally serious even though the assigned vector scores availability impact only (C:N/I:N/A:H). Exploitability is gated on local access — this is not remotely reachable, requiring an attacker to already have local low-privileged code execution or control of a Trusted Application that can invoke the CE82 SHA-3 path. No public exploit, no Nuclei template, not in CISA KEV, and EPSS is negligible (0.11%), so near-term mass-exploitation risk is low. The real risk driver is fleet-wide exposure: embedded/edge devices running OP-TEE 3.21.0–4.10.x with SHA3 Crypto Extensions enabled often have slow, OEM-gated firmware update cycles, so unpatched exposure can persist for a long time after disclosure.

How does the attack unfold?

Local Access

Attacker obtains local low-privileged code execution on the device, or control of a Trusted Application, sufficient to invoke TEE cryptographic operations.

Trigger SHA-3 CE Path

Attacker invokes a hashing operation that routes through OP-TEE's ARMv8.2 SHA-3 Crypto Extensions accelerated implementation on affected CFG_CRYPTO_WITH_CE82=y builds.

Heap Overflow

The off-by-one error (CWE-787) writes past the buffer, triggering a massive heap overflow that corrupts all TEE kernel memory following the hash state.

Impact

The TEE kernel crashes or its memory integrity is corrupted, disrupting TEE-backed functions such as secure model/key storage and attestation for on-device AI workloads.

AML.T0037

Local Access

Attacker obtains local low-privileged code execution on the device, or control of a Trusted Application, sufficient to invoke TEE cryptographic operations.

Trigger SHA-3 CE Path

Attacker invokes a hashing operation that routes through OP-TEE's ARMv8.2 SHA-3 Crypto Extensions accelerated implementation on affected CFG_CRYPTO_WITH_CE82=y builds.

Heap Overflow

The off-by-one error (CWE-787) writes past the buffer, triggering a massive heap overflow that corrupts all TEE kernel memory following the hash state.

Impact

The TEE kernel crashes or its memory integrity is corrupted, disrupting TEE-backed functions such as secure model/key storage and attestation for on-device AI workloads.

AML.T0037

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 5% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Upgrade OP-TEE to 4.11.0 or later on all affected builds. Where immediate upgrade isn't feasible, apply the vendor workaround: set CFG_CRYPTO_WITH_CE82=n to disable the SHA-3 Crypto Extensions path and rebuild firmware. Inventory which device/firmware images in your edge or embedded AI fleet are built on OP-TEE 3.21.0 through 4.10.x with CE82 enabled — this typically requires coordination with SoC/OEM vendors since OP-TEE is usually vendored into board support packages. For detection, monitor for unexpected TEE kernel panics or OP-TEE core dumps in device telemetry, and audit build configurations across the fleet for CFG_CRYPTO_WITH_CE82 usage before the next firmware release cycle.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Code Execution Inference Model AML.T0037 - Data from Local System

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - AI system security controls

NIST AI RMF

MANAGE-2.3 - Third-party AI system component risks are managed

Frequently Asked Questions

What is CVE-2026-40257?

OP-TEE, the open-source TrustZone Trusted Execution Environment shipped across ARM-based edge, mobile, and IoT silicon, has an off-by-one error in its hardware-accelerated SHA-3 implementation that triggers a massive heap overflow corrupting TEE kernel memory on any platform built with CFG_CRYPTO_WITH_CE82=y. For CISOs overseeing edge AI or embedded ML deployments this matters because OP-TEE is commonly the hardware root of trust protecting model weights, cryptographic keys, and secure boot chains on ARMv8.2+ NPUs and SoCs — a local, low-privileged attacker who can trigger the SHA-3 Crypto Extensions path (AV:L, PR:L, no user interaction required, CVSS 5.5) can crash or corrupt that trust anchor. EPSS sits at just 0.11%, there is no public exploit or Nuclei template, and it is not in CISA KEV, so this is not an imminent mass-exploitation risk, but the bug is trivially reachable once local access exists (low attack complexity, CWE-787 out-of-bounds write, twice-listed reflecting the underlying flaw's write primitive). Patch to OP-TEE 4.11.0, or apply the interim workaround of setting CFG_CRYPTO_WITH_CE82=n and rebuilding affected firmware while coordinating with SoC/OEM vendors on rollout to already-fielded devices.

Is CVE-2026-40257 actively exploited?

No confirmed active exploitation of CVE-2026-40257 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-40257?

Upgrade OP-TEE to 4.11.0 or later on all affected builds. Where immediate upgrade isn't feasible, apply the vendor workaround: set CFG_CRYPTO_WITH_CE82=n to disable the SHA-3 Crypto Extensions path and rebuild firmware. Inventory which device/firmware images in your edge or embedded AI fleet are built on OP-TEE 3.21.0 through 4.10.x with CE82 enabled — this typically requires coordination with SoC/OEM vendors since OP-TEE is usually vendored into board support packages. For detection, monitor for unexpected TEE kernel panics or OP-TEE core dumps in device telemetry, and audit build configurations across the fleet for CFG_CRYPTO_WITH_CE82 usage before the next firmware release cycle.

What systems are affected by CVE-2026-40257?

This vulnerability affects the following AI/ML architecture patterns: edge/on-device AI inference, secure enclave model protection, AI accelerator secure boot chains, biometric authentication pipelines.

What is the CVSS score for CVE-2026-40257?

CVE-2026-40257 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.15%.

What is the AI security impact?

Affected AI Architectures

edge/on-device AI inferencesecure enclave model protectionAI accelerator secure boot chainsbiometric authentication pipelines

MITRE ATLAS Techniques

AML.T0037 Data from Local System

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE-2.3

What are the technical details?

Original Advisory

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.21.0 and prior to version 4.11.0, the ARM Crypto Extensions accelerated SHA-3 implementation has an off-by-one error that can cause a massive heap overflow that corrupts all TEE kernel memory following the hash state. This affects all platforms built with `CFG_CRYPTO_WITH_CE82=y` (ARMv8.2+ with SHA3 Crypto Extensions). Version 4.11.0 contains a patch. As a workaround, disable SHA3 Crypto Extensions with `CFG_CRYPTO_WITH_CE82=n`.

Exploitation Scenario

An attacker who already has local low-privileged code execution in the normal world, or who controls a malicious/compromised Trusted Application, invokes a cryptographic operation that routes through the ARMv8.2 SHA-3 Crypto Extensions accelerated path in OP-TEE. The off-by-one error in that implementation writes one element past its buffer, and because the flaw sits in a hot hashing routine the resulting heap overflow is 'massive,' corrupting all TEE kernel memory that follows the hash state. On an edge AI device this could crash the TEE outright (denial of service to any TEE-backed function, including secure model loading or attestation) or, if leveraged further, corrupt adjacent kernel structures in ways that undermine the integrity checks OP-TEE performs on protected model weights, keys, or secure boot chains — turning a memory-safety bug in commodity crypto code into a foothold against the AI system's hardware root of trust.

Weaknesses (CWE)

CWE-787 Out-of-bounds Write Primary CWE-787 Out-of-bounds Write

CWE-787 — Out-of-bounds Write: The product writes data past the end, or before the beginning, of the intended buffer.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.