CVE-2026-118785: NXP MCUXpresso SDK TrustZone-M Examples before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions
Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples (trustzoneexamples), affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channel, TOCTOU condition, or format-string misuse, potentially resulting in secure-world memory disclosure or denial of service. All software versions starting from 26.06.01-lts and 26.09.00 have fixed this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples)to a version that resolves this vulnerability.Fixed in 26.06.01-lts - Upgrade
Upgrade
NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples)to a version that resolves this vulnerability.Fixed in 26.09.00
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize applications built from the MCUXpresso SDK TrustZone-M examples (trustzone_examples) that use NSC veneer functions and are based on versions through 26.06.00-lts or 26.09.00-pvw2. The provided information identifies the examples, not all SDK components, as affected.
What level of attacker access is needed?
An attacker needs to be able to act as a non-secure-world caller of the affected NSC veneer functions. Exploitation involves supplying unvalidated pointers or untrusted data to those secure gateway functions.
What should be done if the affected examples are in use?
Update to a fixed release: 26.06.01-lts or later in that release line, or 26.09.00 or later. If updating cannot occur immediately, review NSC veneer functions for non-secure pointers and untrusted input that are used without validation.
How can teams determine whether they may already be affected?
Identify the SDK version used to build the firmware and determine whether the project incorporates the TrustZone-M trustzone_examples or their NSC veneer code. Versions through 26.06.00-lts and 26.09.00-pvw2 should be treated as affected when that code is present.