Read the docs
TI-2026-86154 Aliases CVE-2026-118785GHSA-fccx-r75p-cw55

Improper input validation in NXP MCUXpresso SDK TrustZone-M examples

Priority LOW 29CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples) before 26.06.01-lts and 26.09.00 do not properly validate non-secure-world input in their NSC veneer functions (CWE-20). A non-secure caller can supply unvalidated pointers or untrusted data, which may lead to secure-world memory disclosure or denial of service. Exploiting it requires local access and a high-complexity attack, with no privileges or user interaction needed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples), affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channel, TOCTOU condition, or format-string misuse, potentially resulting in secure-world memory disclosure or denial of service. All software versions starting from 26.06.01-lts and 26.09.00 have fixed this issue.

Why it matters now

EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed MCUXpresso SDK (NXP): 26.09.00, 26.06.01-lts

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NXPMCUXpresso SDKbefore 26.09.00; before 26.06.01-lts26.09.00, 26.06.01-ltsPatch availableCNA
  • MCUXpresso SDK VendorNXP Affected before 26.09.00; before 26.06.01-lts Fixed in 26.09.00, 26.06.01-lts Patch available CNA

Remediation

Update MCUXpresso SDK to version 26.09.00 or 26.06.01-lts, which fix this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA MCUXpresso SDK (NXP) Fixed in 26.09.00, 26.06.01-lts

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    NXP MCUXpresso SDK — mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-86160 NXP MCUXpresso SDK rpmsg-lite TZM Secure Memory Disclosure via NSC VeneersPriority LOW 29
    Show all 2 records → Advisory →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-118785
  2. 2026-11-07 Alias added: GHSA-fccx-r75p-cw55
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2021-05573 NXP MQX Integer Overflow or Wraparound CVSS 3.1CRITICAL 9.8
  • TI-2021-08911 NXP MCUXpresso SDK Integer Overflow or Wraparound CVSS 3.1CRITICAL 9.8
  • TI-2019-10598 On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC)… CVSS 3.1CRITICAL 9.8
  • TI-2019-13063 The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does… CVSS 3.1HIGH 8.8
  • TI-2022-07063 NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and… CVSS 3.1HIGH 7.8
  • TI-2017-14764 Out-of-bounds write in NXP MQX Classic RTCS UDP recvfrom() CVSS 3.1MEDIUM 6.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences