CVE-2026-102709: eclipse foundation threadx

Vulnerability summary

CVE-2026-102709 is a high (CVSS 8.4) vulnerability in eclipse foundation threadx. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 0.9% of scored vulnerabilities.

Timeline

1. 29-09-2026
   PublishedVulnerability first disclosed.
2. 30-09-2026
   Last modifiedVulnerability information updated.

Description

Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-501Trust Boundary ViolationThe product mixes trusted and untrusted data in the same data structure or structured message.
• CWE-822Untrusted Pointer DereferenceThe product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.