{"id":"CVE-2026-118786","published":"2026-11-06T23:17:20.970","lastModified":"2026-11-10T15:17:13.823","description":"Improper input validation in non-secure-callable (NSC)\nveneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example\n(multicore_examples/rpmsg_lite_pingpong_tzm) up to releases 26.06.00-lts and\n26.09.00 may allow a non-secure caller to supply unvalidated pointers and size\nvalues, potentially resulting in disclosure of secure-world memory to the\nnon-secure domain, or denial of service. All software versions starting from\n26.06.01-lts and 26.12.00-pvw1 have fixed this issue.","cvssScore":6.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}