CVE-2026-102709

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Description
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware reveal which secure bytes are zero, write chosen secure words, and fault the secure world, breaking TrustZone-M isolation and enabling recovery of secure-world secrets such as cryptographic keys.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Improper Validation of Non‑Secure Pointers in ThreadX Leads to Secure Memory Disclosure
Type Values Removed Values Added
Description Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material. In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware reveal which secure bytes are zero, write chosen secure words, and fault the secure world, breaking TrustZone-M isolation and enabling recovery of secure-world secrets such as cryptographic keys.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Improper Validation of Non‑Secure Pointers in ThreadX Leads to Secure Memory Disclosure
Type Values Removed Values Added
First Time appeared Eclipse
Eclipse threadx
Vendors & Products Eclipse
Eclipse threadx
Type Values Removed Values Added
Description Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material.
Weaknesses CWE-200
CWE-501
CWE-822
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
eclipse
Published
Updated
Nov 3, 2026, 4:06 PM
Reserved
Sep 29, 2026, 4:15 PM

View source JSON

Updated
Sep 30, 2026, 8:39 PM

JSON

Status
Awaiting Analysis
Published
Sep 29, 2026, 6:17 PM
Modified
Nov 3, 2026, 5:17 PM

View source JSON

No data.

Updated
Nov 3, 2026, 7:15 PM

JSON