Arm Trusted Firmware M
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Arm Trusted Firmware M.
By the Year
In 2026 there have been 0 vulnerabilities in Arm Trusted Firmware M. Last year, in 2025 Trusted Firmware M had 1 security vulnerability published. Right now, Trusted Firmware M is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 1 | 0.00 |
| 2024 | 2 | 4.70 |
| 2023 | 1 | 7.50 |
| 2022 | 1 | 7.80 |
| 2021 | 1 | 5.50 |
It may take a day or so for new Trusted Firmware M vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Arm Trusted Firmware M Security Vulnerabilities
Stack VULN in Trusted Firmware-M 2.1.3 FWU: RCE via TLV Length Overflow
CVE-2025-53022
- July 30, 2025
TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade (FWU) module does not validate the length field of the Type-Length-Value (TLV) structure for dependent components against the maximum allowed size. If the length specified in the TLV exceeds the size of the buffer allocated on the stack, the FWU module will overwrite the buffer (and potentially other stack data) with the TLV's value content. An attacker could exploit this by crafting a malicious TLV entry in the unprotected section of the MCUBoot upgrade image. By setting the length field to exceed the expected structure size, the attacker can manipulate the stack memory of the system during the upgrade process.
Trusted Firmware-M <= 2.1.0 Unvalidated Mailbox Arg Ptr Enables RCE
CVE-2024-45746
- October 09, 2024
An issue was discovered in Trusted Firmware-M through 2.1.0. User provided (and controlled) mailbox messages contain a pointer to a list of input arguments (in_vec) and output arguments (out_vec). These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length field. After a PSA call, the length of the output arguments behind the unchecked pointer is updated in mailbox_direct_reply, regardless of the call result. This allows an attacker to write anywhere in the secure firmware, which can be used to take over the control flow, leading to remote code execution (RCE).
Trusted FirmwareM 2.0.0 Vulnerable Logging Subsystem Allows Sensitive Data Leak
CVE-2023-51712
4.7 - Medium
- September 05, 2024
An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data via the login function.
TF-M Auth Tag Verify Bug Partial 16-Byte Check (CVE-2023-40271)
CVE-2023-40271
7.5 - High
- September 08, 2023
In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the Authenticated Encryption with Associated Data Chacha20-Poly1305 algorithm is used, with the single-part verification function (defined during the build-time configuration phase) implemented with a dedicated function (i.e., not relying on usage of multipart functions), the buffer comparison during the verification of the authentication tag does not happen on the full 16 bytes but just on the first 4 bytes, thus leading to the possibility that unauthenticated payloads might be identified as authentic. This affects TF-Mv1.6.0, TF-Mv1.6.1, TF-Mv1.7.0, and TF-Mv1.8.
Incorrect Comparison
Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition
CVE-2021-43619
7.8 - High
- March 01, 2022
Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations.
Classic Buffer Overflow
In Arm Trusted Firmware M through 1.2
CVE-2021-27562
5.5 - Medium
- May 25, 2021
In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.
Memory Corruption
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Arm Trusted Firmware M or by Arm? Click the Watch button to subscribe.
