CVE-2026-45702

The record

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.3.0 and prior to version 4.11.0, a type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_CORE_SEL1_SPMC=y` and `CFG_SECURE_PARTITION=y`. Version 4.11.0 fixes the issue.

Affected packages

Related vulnerabilities

• CVE-2026-109282 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in… CWE-843
• CVE-2026-106587 In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes… CWE-843
• CVE-2026-106446 Handlebars provides the power necessary to let users build semantic templates. CWE-843
• CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-843
• CVE-2026-15461 The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later… CWE-843
• CVE-2026-87636 Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… CWE-843
• CVE-2026-87612 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to… CWE-843
• CVE-2026-87564 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to… CWE-843