{"id":"CVE-2026-118785","published":"2026-11-06T23:17:20.840","lastModified":"2026-11-10T15:17:13.677","description":"Improper handling of non-secure-world input in NSC veneer\nfunctions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples),\naffecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a\nnon-secure caller to supply unvalidated pointers or untrusted data, causing a\ntiming side-channel, TOCTOU condition, or format-string misuse, potentially\nresulting in secure-world memory disclosure or denial of service. All software\nversions starting from 26.06.01-lts and 26.09.00 have fixed this issue.","cvssScore":6.7,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}