CVE-2026-118786: NXP MCUXpresso SDK rpmsg-lite TZM Example before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions
Improper input validation in non-secure-callable (NSC) veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example (multicoreexamples/rpmsglitepingpongtzm) up to releases 26.06.00-lts and 26.09.00 may allow a non-secure caller to supply unvalidated pointers and size values, potentially resulting in disclosure of secure-world memory to the non-secure domain, or denial of service. All software versions starting from 26.06.01-lts and 26.12.00-pvw1 have fixed this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NXP MCUXpresso SDK rpmsg-lite multicore example (multicore_examples/rpmsg_lite_pingpong_tzm)to a version that resolves this vulnerability.Fixed in 26.06.01-lts
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects the rpmsg-lite TrustZone-M multicore example at multicore_examples/rpmsg_lite_pingpong_tzm in MCUXpresso SDK releases up to 26.06.00-lts and 26.09.00. The provided information does not establish impact on other SDK components or applications.
What does an attacker need to exploit this?
An attacker needs the ability to act as a non-secure caller of the example's NSC veneer functions. Exploitation involves supplying pointer and size values that are not validated by those functions.
What can exploitation cause?
A successful exploit may disclose secure-world memory to the non-secure domain or cause denial of service. The information provided does not describe code execution or modification of secure-world memory.
Which releases contain the fix?
The issue is fixed in all software versions starting with 26.06.01-lts and 26.12.00-pvw1. Releases up to 26.06.00-lts and 26.09.00 are identified as affected.