What is GHSA-fccx-r75p-cw55?

GHSA-fccx-r75p-cw55 is a security advisory published by GitHub Security Advisories with Medium severity. Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK...

Which CVE IDs does GHSA-fccx-r75p-cw55 cover?

GHSA-fccx-r75p-cw55 covers the following CVE IDs: CVE-2026-118785. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fccx-r75p-cw55?

GHSA-fccx-r75p-cw55 has a CVSS v3 base score of 6.7, published by GitHub Security Advisories.

GHSA-fccx-r75p-cw55MediumCVSS 6.7

Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK...

Vendor

GitHub Security Advisories

Published

November 7, 2026

Last Modified

November 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-118785 →

📋 Description

Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples), affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channel, TOCTOU condition, or format-string misuse, potentially resulting in secure-world memory disclosure or denial of service. All software versions starting from 26.06.01-lts and 26.09.00 have fixed this issue.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-118785
https://mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html
https://github.com/advisories/GHSA-fccx-r75p-cw55