CVE-2021-27562: Arm Trusted Firmware-M out-of-bounds write in NSPE handler mode

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCISA KEV listing confirms real-world exploitation, and the flaw breaks the secure/non-secure isolation boundary, though it requires local low-privileged access and rates only medium CVSS.

What it is

Trusted Firmware-M through 1.2 mishandles secure function calls made from the Non-Secure Processing Environment handler mode, allowing an out-of-bounds write (CWE-787). A non-secure caller can therefore halt the system, overwrite secure data, or cause secure data to be printed. The flaw undermines the isolation boundary that TF-M exists to enforce.

Impact

An attacker with local non-secure code execution can corrupt or disclose secure-world data and cause a denial of service via system halt. Integrity and availability of the secure partition are at risk; confidentiality impact is not reflected in the CVSS vector but the description explicitly mentions printing of secure data.

Attack surface

Reached locally by non-secure world code invoking secure functions under the NSPE handler mode; the CVSS vector is AV:L/PR:L/UI:N, so low-privileged local access is required and no user interaction is needed. No network vector is described.

Exploitation

Listed in CISA KEV with a due date of 2021-11-17, indicating known exploitation in the wild; EPSS 30-day probability is about 3.1 percent (87th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor update per Arm security guidance and the TF-M security advisory for the SVC caller SP fetching vulnerability; upgrade past TF-M 1.2.
• If immediate patching is not possible, restrict or disable non-secure calls into the affected secure function paths.
• Review and harden the NSPE handler-mode entry path so non-secure callers cannot reach privileged secure routines.
• Track KEV remediation deadlines and verify deployed TF-M versions across all devices using the firmware.

Detection

• Inventory firmware images and confirm TF-M version; flag any device still running 1.2 or earlier.
• Monitor for unexpected system halts or resets originating from non-secure world activity.
• Watch for anomalous secure-world data appearing in non-secure logs or debug output.
• Audit non-secure callers invoking secure functions under NSPE handler mode for unexpected or malformed arguments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.