Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0015 5.2 —
AFFECTED Product Versions Fixed optee_os >= 4.3.0, < 4.11.0 – —
TIMELINE May 13 Reserved by GitHub_M Jun 3 EXPLOIT PUBLISHED — CVE-2026-45702 (OP-TEE optee_os). Public exploit reference added. Jun 3 Published (CNA: GitHub_M)
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.3.0 and prior to version 4.11.0, a type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_CORE_SEL1_SPMC=y` and `CFG_SECURE_PARTITION=y`. Version 4.11.0 fixes the issue.
| Date | Event | Detail |
|---|---|---|
| May 13, 2026 | Reserved | Reserved by GitHub_M |
| June 3, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-45702 (OP-TEE optee_os). Public exploit reference added. |
| June 3, 2026 | Published | Published (CNA: GitHub_M) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| OP-TEE | optee_os | — | >= 4.3.0, < 4.11.0 | — |
Authoritative record: CVE-2026-45702 at cve.org
Vendors: op-tee
Weaknesses: CWE-843
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-45702 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.