CVE-2024-45746

An issue was discovered in Trusted Firmware-M through 2.1.0. User provided (and controlled) mailbox messages contain a pointer to a list of input arguments (in_vec) and output arguments (out_vec). These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length field. After a PSA call, the length of the output arguments behind the unchecked pointer is updated in mailbox_direct_reply, regardless of the call result. This allows an attacker to write anywhere in the secure firmware, which can be used to take over the control flow, leading to remote code execution (RCE).

• CWE-120

• https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/user_pointers_mailbox_vectors_vulnerability.html
• https://www.trustedfirmware.org/projects/tf-m/

Published

Oct 9, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45740In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splu…5.4
• CVE-2024-45741In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splu…5.4
• CVE-2024-45742Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-45743Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-45744TopQuadrant TopBraid EDG stores external credentials insecur…4.3
• CVE-2024-45745TopQuadrant TopBraid EDG before version 8.0.1 allows an auth…4.3
• CVE-2024-4575The LayerSlider plugin for WordPress is vulnerable to Stored…6.4
• CVE-2024-45750An issue in TheGreenBow Windows Standard VPN Client 6.87.108…7.3
• CVE-2024-45751tgt (aka Linux target framework) before 1.0.93 attempts to a…5.9
• CVE-2024-45752logiops through 0.3.4, in its default configuration, allows …7.3
• CVE-2024-45753In Mahara 23.04.8 and 24.04.4, the external RSS feed block c…6.1
• CVE-2024-45754An issue was discovered in the centreon-bi-server component …7.2