CVE-2026-54467
Received Received - Intake

Mailbox Pointer Validation Flaw in Trusted Firmware-M

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: MITRE

Description
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-54467
EUVD
EUVD-2026-66233

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
trusted_firmware_m tf-m to 2.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-283 The product does not properly verify that a critical resource is owned by the proper entity.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Trusted Firmware-M (TF-M) versions 2 through 2.3.0. It involves improper handling of a pointer during mailbox initialization on PSOC64 and RP2350 platforms. A non-secure, unvalidated pointer is accepted, which could allow unauthorized access or manipulation of memory.

Impact Analysis

This vulnerability could allow an attacker with local access and limited privileges to escalate their access level. It may lead to unauthorized code execution, data breaches, or system compromise on affected devices using TF-M versions 2 through 2.3.0.

Mitigation Strategies

Update Trusted Firmware-M to version 2.3.0 or later to address the mailbox initialization issue. Ensure secure validation of pointers in PSOC64 and RP2350 platforms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54467. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart