Status: UPDATED
| Advisory ID: CVE-2026-102709
Key Details
| CVE | CVE-2026-102709 |
| CVSS Score / Version | 8.4 (High) / CVSS v4.0 |
| Updated | 2026-09-30 |
| Affected products | eclipse ThreadX |
| Classified as | CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) |
Affected Products, Subsystems & Sectors
| Subsystems | OT Supporting Infrastructure |
| Sectors | Multiple |
What to Know
Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material. (NVD)
What to Do
Monitor eclipse's web page for any future patch releases.
References