CVE-2026-102709

Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secur…

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware reveal which secure bytes are zero, write chosen secure words, and fault the secure world, breaking TrustZone-M isolation and enabling recovery of secure-world secrets such as cryptographic keys.