CVE-2026-102709: Eclipse Foundation Threadx

High severity, CVSS 8.4. EPSS: 0.1% chance of exploitation in the next 30 days.

Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material.

Affected products

• Eclipse Foundation Threadx: up to and including 6.5.1.202602

Published 2026-09-29. Last modified 2026-09-30.