Read the docs
TI-2026-86160 Aliases CVE-2026-118786GHSA-6855-6r26-x36x

NXP MCUXpresso SDK rpmsg-lite TZM Secure Memory Disclosure via NSC Veneers

Priority LOW 29CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Improper input validation (CWE-20) in the non-secure-callable (NSC) veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example (multicore_examples/rpmsg_lite_pingpong_tzm) lets a non-secure caller pass unvalidated pointers and size values. A successful attack can disclose secure-world memory to the non-secure domain or cause a denial of service. Versions before 26.06.01-lts and before 26.12.00-pvw1 are affected. The CVSS 3.1 base score is 6.8 (MEDIUM).

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Improper input validation in non-secure-callable (NSC) veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example (multicore_examples/rpmsg_lite_pingpong_tzm) up to releases 26.06.00-lts and 26.09.00 may allow a non-secure caller to supply unvalidated pointers and size values, potentially resulting in disclosure of secure-world memory to the non-secure domain, or denial of service. All software versions starting from 26.06.01-lts and 26.12.00-pvw1 have fixed this issue.

Why it matters now

EPSS 0.0017 6th percentileScored 2026-11-07
Fix Fixed MCUXpresso SDK (NXP): 26.12.00-pvw1, 26.06.01-lts

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NXPMCUXpresso SDKbefore 26.12.00-pvw1; before 26.06.01-lts26.12.00-pvw1, 26.06.01-ltsPatch availableCNA
  • MCUXpresso SDK VendorNXP Affected before 26.12.00-pvw1; before 26.06.01-lts Fixed in 26.12.00-pvw1, 26.06.01-lts Patch available CNA

Remediation

Upgrade to 26.06.01-lts or 26.12.00-pvw1, which contain the fix. Earlier releases remain affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA MCUXpresso SDK (NXP) Fixed in 26.12.00-pvw1, 26.06.01-lts

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    NXP MCUXpresso SDK — mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-86154 Improper input validation in NXP MCUXpresso SDK TrustZone-M examplesPriority LOW 29
    Show all 2 records → Advisory →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-118786
  2. 2026-11-07 Alias added: GHSA-6855-6r26-x36x
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2021-05573 NXP MQX Integer Overflow or Wraparound CVSS 3.1CRITICAL 9.8
  • TI-2021-08911 NXP MCUXpresso SDK Integer Overflow or Wraparound CVSS 3.1CRITICAL 9.8
  • TI-2019-10598 On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC)… CVSS 3.1CRITICAL 9.8
  • TI-2019-13063 The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does… CVSS 3.1HIGH 8.8
  • TI-2022-07063 NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and… CVSS 3.1HIGH 7.8
  • TI-2017-14764 Out-of-bounds write in NXP MQX Classic RTCS UDP recvfrom() CVSS 3.1MEDIUM 6.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences