EUVD-2026-66233Severity by source
AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Physical access required to program NS firmware; high complexity for initialization-phase pointer injection; scope crosses TrustZone-M boundary into SPE with full impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.
AnalysisAI
Mailbox initialization in Trusted Firmware-M (TF-M) versions 2 through 2.3.0 on PSOC64 and RP2350 platforms fails to validate a pointer supplied by non-secure world code, allowing a low-privileged attacker with physical access to supply a crafted pointer that crosses the TrustZone-M hardware security boundary. Successful exploitation yields full read, write, and denial-of-service capability over the Secure Processing Environment (SPE), collapsing the hardware-enforced isolation TF-M is designed to guarantee - including potential exposure of cryptographic keys, attestation credentials, and secure boot state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) The target device must be a PSOC64 or RP2350 platform running Trusted Firmware-M versions 2 through 2.3.0 - other TF-M platforms are not identified as vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.0 base score (AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) captures a physically-accessed, high-complexity attack with a full scope change into the secure world - severe in consequence but tightly constrained in reach. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update Trusted Firmware-M to a build incorporating commit 00d1b3e or later, which introduces validation of the non-secure-supplied pointer during mailbox initialization on PSOC64 and RP2350 platforms. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all devices, firmware versions, and supply-chain checkpoints currently running TF-M 2.0-2.3.0, with particular focus on PSOC64 and RP2350 platforms; contact your TF-M distribution channel and device vendors to confirm patch availability and timelines. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Trusted Firmware M
View allIn Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the print
Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. Rated high severity
In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the e
In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell P
Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. Rated medium severity (CVSS 5
An issue was discovered in Trusted Firmware-M through 2.0.0. Rated medium severity (CVSS 4.7). No vendor patch available
Same weakness CWE-283 – Unverified Ownership
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today