In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware reveal which secure bytes are zero, write chosen secure words, and fault the secure world, breaking TrustZone-M isolation and enabling recovery of secure-world secrets such as cryptographic keys.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00104.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Eclipse Subscribe
Threadx Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Eclipse Subscribe
Threadx Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-ffg5-m7vh-vwrp cve-icon cve-icon
History

Tue, 03 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Title Improper Validation of Non‑Secure Pointers in ThreadX Leads to Secure Memory Disclosure

Tue, 03 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
Description Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material. In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware reveal which secure bytes are zero, write chosen secure words, and fault the secure world, breaking TrustZone-M isolation and enabling recovery of secure-world secrets such as cryptographic keys.

Wed, 30 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Title Improper Validation of Non‑Secure Pointers in ThreadX Leads to Secure Memory Disclosure

Tue, 29 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse threadx
Vendors & Products Eclipse
Eclipse threadx

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material.
Weaknesses CWE-200
CWE-501
CWE-822
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-11-03T16:06:06.478Z

Reserved: 2026-09-29T16:15:06.474Z

Link: CVE-2026-102709

cve-icon Vulnrichment

Updated: 2026-09-30T20:39:02.966Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:09.863

Modified: 2026-11-03T17:17:52.287

Link: CVE-2026-102709

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T19:15:14Z

Weaknesses