CVE-2026-102709

Summary

Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material.

Affected Software

Weaknesses

• CWE-200: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• CWE-501: CWE-501 Trust Boundary Violation
• CWE-822: CWE-822 Untrusted Pointer Dereference

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-ffg5-m7vh-vwrp

• ←Previous
• Next→