Trustedfirmware vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-54467 On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplieHigh 7 · Aug 26, 2026
• CVE-2026-34876 An issue was discovered in Mbed TLS 3.x before 3.6.6.High 7.5 · Apr 2, 2026
• CVE-2026-34873 An issue was discovered in Mbed TLS 3.5.0 through 4.0.0.Critical 9.1 · Apr 1, 2026
• CVE-2026-34874 An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0.High 7.5 · Apr 1, 2026
• CVE-2026-25833 Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() functionHigh 7.5 · Apr 1, 2026
• CVE-2026-34875 An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0.Critical 9.8 · Apr 1, 2026
• CVE-2024-45746 An issue was discovered in Trusted Firmware-M through 2.1.0.Critical 9.8 · Oct 9, 2024
• CVE-2024-45159 An issue was discovered in Mbed TLS 3.x before 3.6.1.Critical 9.8 · Sep 5, 2024
• CVE-2024-23744 An issue was discovered in Mbed TLS 3.5.1.High 7.5 · Jan 21, 2024
• CVE-2023-40271 In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selectedHigh 7.5 · Sep 7, 2023
• CVE-2022-47630 Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates.High 7.4 · Jan 16, 2023
• CVE-2021-43619 Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition.High 7.8 · Mar 1, 2022
• CVE-2021-45450 In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output bufHigh 7.5 · Dec 21, 2021
• CVE-2021-44149 An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0.High 7.8 · Dec 7, 2021
• CVE-2021-36133 The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure WorHigh 7.1 · Dec 7, 2021
• CVE-2019-25052 In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crasCritical 9.1 · Aug 11, 2021
• CVE-2021-32032 In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) can prevent the abortHigh 7.5 · May 21, 2021
• CVE-2017-15031 In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure world timing informHigh 7.5 · Dec 18, 2018
• CVE-2017-9607 The BL1 FWU SMC handling code in ARM Trusted Firmware before 1.4 might allow attackers to write arbitrary data to secure memory, bypass the bl1_plat_mem_check pHigh 7 · Sep 20, 2017
• CVE-2017-7564 In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service (secure world paHigh 7.5 · Jun 7, 2017
• CVE-2017-7563 In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism.High 8.1 · Jun 7, 2017
• CVE-2016-6129 The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the AHigh 7.5 · Feb 13, 2017