CVE-2026-118786 · Package
NO FIX YET · SEE WHAT TO DO
The NXP MCUXpresso SDK rpmsg-lite multicore example exposes non-secure-callable veneer functions that accept pointers and sizes without validation. A non-secure caller can read secure-world memory or crash the device.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only projects built on the NXP MCUXpresso SDK rpmsg-lite TrustZone multicore example are exposed, and the flaw matters where non-secure code can call the secure-side veneer functions. Teams using other SDK examples or no TrustZone multicore setup can skip it.
Not affected if no-trustzone-multicore, other-sdk-examples
Who cares embedded, mcuxpresso-sdk, nxp, rpmsg-lite, trustzone
multicore_examples/rpmsg_lite_pingpong_tzm example from the MCUXpresso SDK.26.06.00-lts and 26.09.00.26.06.01-lts or later in the 26.06 line.26.12.00-pvw1 or later.Improper input validation in non-secure-callable (NSC) veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example (multicore_examples/rpmsg_lite_pingpong_tzm) up to releases 26.06.00-lts and 26.09.00 may allow a non-secure caller to supply unvalidated pointers and size values, potentially resulting in disclosure of secure-world memory to the non-secure domain, or denial of service. All software versions starting from 26.06.01-lts and 26.12.00-pvw1 have fixed this issue.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.