Search/CVE-2026-54467
● CVE — High

CVE-2026-54467

DiscoveredAug 26, 2026UpdatedSep 9, 2026

On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.

View graph Watch Export
CVSS v3.1
7 HIGH
EPSS
0.17%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 27, 2026 → Sep 25, 2026
▲ 0.02pp
0.15% → 0.17% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorPHYSICAL
Attack ComplexityHIGH
Privileges RequiredLOW
User InteractionNONE
ScopeCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Connections
1 relationships
Timeline
disclosure → media coverage
Aug 26, 2026
Disclosure — published as a CVE record. · last revised by NVD Sep 9, 2026