CVE-2026-54467
CVE-2026-54467
This page contains facts from public vulnerability sources. Check the original advisory before updating.
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.
CVSS 7.0 · High · EPSS 0.2%
- Published
- Updated
Stack: system
Affected products and versions
trusted firmware-m
- Versions
- ≥ 0, < 00d1b3e716dc636f7ad4398980ae55427dc1731d: Affected (git)
No fix published
arm-trusted-firmware Ubuntu:20.04:LTS
- Versions
- 2.1-3
- 2.2-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
arm-trusted-firmware Ubuntu:22.04:LTS
- Versions
- 2.5+dfsg-1
- 2.6+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
arm-trusted-firmware Ubuntu:24.04:LTS
- Versions
- 2.9.0+dfsg-3
- 2.10.0+dfsg-1
- 2.10.0+dfsg-1build1
- 2.10.0+dfsg-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
arm-trusted-firmware Ubuntu:26.10
- Versions
- 2.12.1+dfsg-1
- 2.12.1+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
arm-trusted-firmware Ubuntu:26.04:LTS
- Versions
- 2.10.0+dfsg-1build2
- 2.12.1+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published