CVE-2026-118785

06.11.2026, 23:17

Improper handling of non-secure-world input in NSC veneer
functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples),
affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a
non-secure caller to supply unvalidated pointers or untrusted data, causing a
timing side-channel, TOCTOU condition, or format-string misuse, potentially
resulting in secure-world memory disclosure or denial of service. All software
versions starting from 26.06.01-lts and 26.09.00 have fixed this issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.7 MEDIUM	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

https://mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html