CVE-2026-118785 · Vendor
NO FIX YET · SEE WHAT TO DO
Example code in NXP's MCUXpresso SDK TrustZone-M samples does not validate pointers and data passed from the non-secure world into secure veneer functions. A non-secure caller can cause secure-world memory disclosure or a denial of service.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only projects that copied or built the TrustZone-M example code from the NXP MCUXpresso SDK are exposed, because the flaw is in the example's secure-world entry functions. Production firmware written from scratch, or projects that do not use these examples, can skip it. The sources do not say whether the example code is commonly reused in shipped products.
Not affected if not-using-trustzone-examples
Who cares embedded, mcuxpresso-sdk, nxp, trustzone-m
trustzone_examples folder of the MCUXpresso SDK.26.06.00-lts and 26.09.00-pvw2.26.06.01-lts or later in the 26.06 line.26.09.00 or later.Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples), affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channel, TOCTOU condition, or format-string misuse, potentially resulting in secure-world memory disclosure or denial of service. All software versions starting from 26.06.01-lts and 26.09.00 have fixed this issue.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.