A stack-use-after-return vulnerability exists in the Arduino_Core_STM32 library before version 1.7.0. The pwm_start() function creates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where the pointer is stored in a global timer handle registry. When pwm_start() returns, the pointer remains registered globally and interrupt service routines may later dereference this dangling pointer, causing memory corruption. This flaw corresponds to CWE‑562 (Access of Uninitialized Variable), and can compromise data integrity by overwriting memory locations.

Any STM32-based project that uses the Arduino_Core_STM32 library and calls the pwm_start() function in a library version earlier than 1.7.0 is affected. Devices with this library are at risk when PWM functionality is utilized.

The EPSS score is reported as < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The CVSS score of 5.3 denotes moderate severity. The attack vector is inferred to involve triggering the pwm_start() function through user‑controlled input or firmware logic that activates PWM, after which interrupt handlers may use an invalid global timer handle. This inference is based on the described behavior of the library and the timing of the dangling pointer usage.