Trusted Firmware‑M (TF‑M) mailbox initialization on PSOC64 and RP2350 fails to validate a non‑secure pointer supplied during initialization. If an attacker can provide a crafted pointer, memory corruption can occur, leading to possible arbitrary code execution or privilege escalation within the secure world. The flaw is identified as CWE‑283.

The vulnerability affects TF‑M versions 2 through 2.3.0, including the platform builds before commit 00d1b3e. Systems that run TF‑M 2.x on NXP’s PSOC64 or Raspberry Pi RP2350 hardware are impacted. No other vendors or products are known to be affected at this time.

The CVSS score is 7, indicating a high severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, current exploitation risk is uncertain, but the lack of pointer safeguards suggests that questionable exploitation paths exist for trusted or privileged attackers who can influence mailbox initialization. Mitigation is advised promptly to prevent potential compromise.