CVE Catalog
CVE-2026-54467
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk0.15%
4th percentile - higher than 4% of all known CVEs
Summary
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.
Risk Assessment
Risk of security compromise by the non-secure world, which can manipulate mailbox initialization, potentially leading to privilege escalation or integrity violation.
Recommendation
Update Trusted Firmware-M to a version containing commit 00d1b3e, which fixes pointer validation during mailbox initialization.
Other vulnerabilities in Trusted Firmware-M
Original NVD description (English source)
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.