In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone‑M ports dereference a thread pointer supplied by the non‑secure world without confirming that it points to non-secure memory. This flaw allows non‑secure code to cause the secure firmware to reveal which secure bytes are zero, to write arbitrary secure words, and to fault the secure world, thereby breaking TrustZone‑M isolation and exposing secure‑world secrets such as cryptographic keys.

The Eclipse ThreadX real‑time operating system for ARM TrustZone‑M is affected, specifically releases in the 6.0.1 through 6.5.2.202603 range. Users should verify that their deployments fall within these version boundaries.

The CVSS score of 8.4 indicates high severity, while the EPSS score of < 1% suggests a very low exploitation probability and the vulnerability is not listed in CISA KEV, meaning no active exploits are known. The likely attack vector requires an attacker with code execution privileges in the non‑secure world who can supply a crafted thread pointer to one of the vulnerable secure stack functions; this is a local privilege escalation against the TrustZone‑M boundary. Because the impact is significant, any system running vulnerable ThreadX code should consider the risk high.