CVE-2026-102709

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-11-03

Assigner: Eclipse Foundation

Description

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware reveal which secure bytes are zero, write chosen secure words, and fault the secure world, breaking TrustZone-M isolation and enabling recovery of secure-world secrets such as cryptographic keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-11-03

Generated

2026-11-08

AI Q&A

2026-09-29

EPSS Evaluated

2026-11-07

NVD

CVE-2026-102709

EUVD

EUVD-2026-89172

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse Foundation	ThreadX	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-822	The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
CWE-501	The product mixes trusted and untrusted data in the same data structure or structured message.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper validation of non-secure pointers in TrustZone-M non-secure callable entry functions. An attacker in the non-secure world can provide pointers to secure memory, which the secure firmware then dereferences without checking if they point to non-secure memory. This allows unintended disclosure of secure memory contents, breaking TrustZone-M's isolation guarantees and potentially enabling memory disclosure or corruption attacks.

Detection Guidance

This vulnerability involves improper validation of non-secure pointers in TrustZone-M NSC entry functions. Detection requires static and dynamic analysis of firmware code to identify NSC functions that dereference non-secure pointers without validation. Use tools like Arm Compiler, TrustZone-aware debuggers, or custom scripts to inspect pointer handling in secure firmware.

Impact Analysis

This vulnerability could allow attackers to read sensitive secure memory contents, including cryptographic material. If exploited, it may lead to unauthorized access to confidential data, compromise of secure applications, or further attacks leveraging exposed secrets. The impact depends on the specific use of TrustZone-M in your system.

Compliance Impact

This vulnerability could violate compliance with GDPR, HIPAA, and other regulations requiring strong data protection and isolation. Unauthorized disclosure of secure memory contents may result in data breaches, leading to legal penalties, reputational damage, and loss of trust. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Update TrustZone-M firmware to a patched version that validates non-secure pointers in NSC entry functions. Review and restrict non-secure world access to secure memory regions. Implement runtime checks to ensure pointers from non-secure memory do not reference secure memory.

Hi! I’m here to help you understand CVE-2026-102709. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...