Improper validation of non-secure pointers in multiple TrustZone-M non-secure callable functions allows code running in the non-secure world to supply pointers that reference secure memory. The secure firmware then dereferences these attacker-controlled pointers without confirming they are non-secure, enabling unintended disclosure or corruption of secure memory contents. This violates the isolation guarantees of Arm TrustZone-M and can expose cryptographic material or other sensitive data.

The Eclipse ThreadX real-time operating system for ARM TrustZone-M is affected. Specific product versions are not enumerated in the advisory; users should verify against their deployed ThreadX releases.

The CVSS score of 8.4 indicates high severity. The EPSS score is not available, so current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA KEV, indicating no active exploits are known at this time. The likely attack vector requires an attacker with code execution privileges in the non-secure world, which is a local privilege escalation against the TrustZone-M boundary. Due to the severe impact, any system running vulnerable ThreadX code should consider the risk high.