Is CVE-2026-118786 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118786 being exploited in the wild.

How severe is CVE-2026-118786?

Medium severity, with a CVSS score of 6.8, published 6 November 2026.

Which products and versions are affected?

NXP MCUXpresso SDK up to 26.06.00-lts and 26.09.00.

Is there a fix for CVE-2026-118786?

Yes: fixed in MCUXpresso SDK 26.06.01-lts, 26.12.00-pvw1 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118786 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-118786?

Check whether you run NXP MCUXpresso SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118786: NXP MCUXpresso SDK improper input validation in NSC veneer functions

CVE-2026-118786 · Severity: medium · CVSS 6.8 · Published 2026-11-06

The NXP MCUXpresso SDK is a development framework for embedded microcontrollers that includes security features for isolating sensitive code. A flaw in the rpmsg-lite multicore example allows untrusted application code to bypass security boundaries and access sensitive memory or crash the system. An attacker with code execution in the non-secure domain could extract cryptographic keys or other secrets from the secure world.

Vendors: NXP.

Quick answers

Is CVE-2026-118786 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118786 being exploited in the wild.
How severe is CVE-2026-118786?: Medium severity, with a CVSS score of 6.8, published 6 November 2026.
Which products and versions are affected?: NXP MCUXpresso SDK up to 26.06.00-lts and 26.09.00.
Is there a fix for CVE-2026-118786?: Yes: fixed in MCUXpresso SDK 26.06.01-lts, 26.12.00-pvw1 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118786 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-118786?: Check whether you run NXP MCUXpresso SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MCUXpresso SDK 26.06.01-lts, 26.12.00-pvw1 and later

Technical details

Improper input validation in non-secure-callable (NSC) veneer functions in the rpmsg-lite TrustZone-M example allows a non-secure caller to supply unvalidated pointers and size values, bypassing trust boundaries. An unprivileged non-secure application can trigger a timing side-channel, TOCTOU condition, or out-of-bounds memory access, leading to disclosure of secure-world memory or denial of service. The vulnerability requires code execution in the non-secure domain.

Affected products

NXP MCUXpresso SDK up to 26.06.00-lts and 26.09.00

Timeline

2026-11-06: disclosed

References

https://mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.