What makes SecMate embedded-oriented?

SecMate is customized and tested on embedded software, which strongly influences our tests and roadmap. See our disclosures for proof at https://secmate.dev/disclosures.

Are you an LLM wrapper?

No. Proprietary static analysis engine. Dataflow. Taint tracking. Reachability. AI sits on top to reason about what the engine finds, not to replace it. Runs on 20B to 120B parameter models, deployed locally. Your code never leaves your infrastructure.

What languages do you support?

C, C++, Rust, Python, TypeScript, and Java.

What about false positives?

We trace actual paths. If an attack can reach it, we tell you. If it's exploitable, we tell you. You fix what matters, not what might matter.

Do I need to replace my existing SAST tools?

Up to you. SecMate can work alone or alongside Semgrep, Coverity, SonarQube, and any tool that exports SARIF. We validate which findings are actually reachable and exploitable and find more with our engine.

Can SecMate ingest results from my current tools?

Yes. If your tool exports SARIF, SecMate can validate those results, assessing reachability and exploitability so you fix what matters.

Where does my code go?

Three options: Cloud SaaS, Private Cloud, or Air-Gapped On-Prem. Use your LLM providers or ours. No training on your code. Zero retention policy.

What does a finding look like?

The vulnerable code. The path an attacker takes to reach it. Why it's exploitable. Severity score. How to fix it.

We have disclosed over 100 vulnerabilities in critical embedded software. NASA, Renesas, Intel, Espressif, Arduino, and others. Reported responsibly. See the full list at https://secmate.dev/disclosures.

Disclosures

TrustedFirmware · optee_os / core

RSASSA PKCS#1 v1.5 Padding Size Underflow

Name: SecMate
Availability: InStock
Author: SecMate

7.5high

SecMateSECMATE-2026-0017

CVE

CVE-2026-33662 NVD

VendorTrustedFirmware

Productoptee_os / core

ClassificationDuplicate

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AdvisoryGHSA-4cf8-v5g3-73gr

Timeline

Reported

Mar 5, 2026

Acknowledged

Mar 20, 2026

Fixed

Apr 24, 2026

Published

Apr 24, 2026

Summary

OP-TEE versions 3.8.0 through 4.10 contain an integer underflow in the accelerated RSASSA PKCS#1 v1.5 encoding path. On platforms registering RSA acceleration, a sufficiently small modulus can underflow the calculated padding length and cause an oversized write across secure-world heap memory, crashing OP-TEE. Version 4.11 contains the patch.

What's hidden in yours?

Find out