Vulnerability in Mailbox Initialization on Trusted Firmware-M for PSOC64 and RP2350

CVE-2026-54467

What is CVE-2026-54467?

The Trusted Firmware-M platforms, specifically versions 2.0 to 2.3.0 before commit 00d1b3e, exhibit a flaw in the mailbox initialization process on PSOC64 and RP2350. This vulnerability arises from the acceptance of a non-secure, unvalidated pointer, which could potentially allow unauthorized access to sensitive data or provide an attack vector for malicious exploits. It is crucial for developers utilizing these platforms to address this issue to mitigate the risks associated with improper input validation.

References