Improper Input Validation in NXP MCUXpresso SDK for RPMSG-LITE Multicore Example
CVE-2026-118786

6.8MEDIUM

Key Information:

Vendor

Nxp

Status
Mcuxpresso Sdk
Vendor
CVE Published:
6 November 2026

What is CVE-2026-118786?

The NXP MCUXpresso SDK's RPMSG-LITE multicore example contains a flaw in its non-secure-callable veneer functions, allowing unvalidated pointers and size values to be supplied by non-secure callers. This improper input validation could lead to the potential disclosure of sensitive secure-world memory to non-secure domains or create conditions for denial of service. Versions 26.06.01-lts and 26.12.00-pvw1 address and rectify this vulnerability.

Affected Version(s)

MCUXpresso SDK 0 < 26.12.00-pvw1

MCUXpresso SDK 0 < 26.06.01-lts

References

https://mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/...
vendor-advisory

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tijs Bellefroid, Antonis Louka, Marton Bognar, Jo Van Bulck (DistriNet, KU Leuven)
.