7

CVE-2026-54467

On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerTrustedFirmware
≫
Produkt Trusted Firmware-M
Default Statusunaffected
Version 0
Version < 00d1b3e716dc636f7ad4398980ae55427dc1731d
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.15% 0.045
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
MITRE 7 0.4 6
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-283 Unverified Ownership

The product does not properly verify that a critical resource is owned by the proper entity.

https://www.trustedfirmware.org/projects/tf-m/
https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/53051/1/docs/security/security_advisories/missing_ns_pointer_validation_mailbox_init.rst#58