CVE-2026-102709 — Vulnerability intelligence
—
Published:
- CVSS
- 8.4
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware reveal which secure bytes are zero, write chosen secure words, and fault the secure world, breaking TrustZone-M isolation and enabling recovery of secure-world secrets such as cryptographic keys.