Is CVE-2026-54467 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54467 being exploited in the wild.

How severe is CVE-2026-54467?

High severity, with a CVSS score of 7, published 26 August 2026.

Which products and versions are affected?

TrustedFirmware Trusted Firmware-M 2.0 through 2.3.0.

Is there a fix for CVE-2026-54467?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-54467 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2026-54467?

Check whether you run TrustedFirmware Trusted Firmware-M at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54467: Trusted Firmware-M mailbox pointer validation vulnerability

CVE-2026-54467 · Severity: high · CVSS 7 · Published 2026-08-26

Trusted Firmware-M (TF-M) is a security platform that protects embedded processors by implementing a secure processing environment for microcontrollers. A flaw in mailbox initialization allows non-secure software to supply an unvalidated pointer, potentially allowing an attacker with code execution in the non-secure world to access or manipulate secure memory regions.

Vendors: TrustedFirmware.

Quick answers

Is CVE-2026-54467 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54467 being exploited in the wild.
How severe is CVE-2026-54467?: High severity, with a CVSS score of 7, published 26 August 2026.
Which products and versions are affected?: TrustedFirmware Trusted Firmware-M 2.0 through 2.3.0.
Is there a fix for CVE-2026-54467?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54467 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2026-54467?: Check whether you run TrustedFirmware Trusted Firmware-M at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an input validation flaw in the mailbox initialization code affecting PSOC64 and RP2350 platforms in TF-M versions 2.0 through 2.3.0. The mailbox accepts a non-secure, unvalidated pointer supplied by non-secure software during initialization. This allows an attacker capable of executing code in the non-secure execution environment to potentially read or write secure memory by providing a malicious pointer value. The issue was fixed in commit 00d1b3e. The vulnerability requires prior code execution in the non-secure domain and affects dual-core platforms where non-secure and secure execution environments are isolated.

Affected products

TrustedFirmware Trusted Firmware-M 2.0 through 2.3.0

Timeline

2026-08-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.