CVE-2026-54467: trustedfirmware trusted_firmware-m Unverified Ownership
CVSS: 7.0v3.1HighDeferred
AliasesUBUNTU-CVE-2026-54467
Published 26-08-2026Last modified 26-08-2026
Vulnerability summary
CVE-2026-54467 is a high (CVSS 7.0) Unverified Ownership vulnerability in trustedfirmware trusted_firmware-m. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.3% of scored vulnerabilities.
CVSS score
7.0/10
010
High · v3.1 (CVE.org)EPSS score
0.17%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 26-08-2026PublishedVulnerability first disclosed.
- 26-08-2026Last modifiedVulnerability information updated.
Description
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 7.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST7.0HighCVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
+0.02 pp
From 0.15% on 20-09-2026
20-09-202620-10-2026
EPSS score0.17%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Trustedfirmware1 product
- trusted_firmware-m< 00d1b3e716dc636f7ad4398980ae55427dc1731d
Ubuntu1 product
- arm-trusted-firmwareAll versions (No fix recorded)
2 vendors · 2 products