Eclipse ThreadX up to 6.5.1.202602 NSC Entry Functions missing initialization

Summaryinfo

A vulnerability identified as very critical has been detected in Eclipse ThreadX up to 6.5.1.202602. This vulnerability affects unknown code of the component NSC Entry Functions. The manipulation leads to missing initialization. This vulnerability is listed as CVE-2026-102709. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Eclipse ThreadX up to 6.5.1.202602. It has been rated as very critical. This issue affects some unknown functionality of the component NSC Entry Functions. The manipulation with an unknown input leads to a missing initialization vulnerability. Using CWE to declare the problem leads to CWE-456. The product does not initialize critical variables, which causes the execution environment to use unexpected values. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-102709 since 09/29/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/29/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• ThreadX

Version

• 6.5.1.202602

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion