Log in Start free

Vulnerability · Published Jul 30, 2025 · Assigned by mitre

CVE-2025-53022

High 8.6

In plain English

A high-severity stack buffer overflow in the arm-trusted-firmware package (Ubuntu). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.5%top 56.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade (FWU) module does not validate the length field of the Type-Length-Value (TLV) structure for dependent components against the maximum allowed size. If the length specified in the TLV exceeds the size of the buffer allocated on the stack, the FWU module will overwrite the buffer (and potentially other stack data) with the TLV's value content. An attacker could exploit this by crafting a malicious TLV entry in the unprotected section of the MCUBoot upgrade image. By setting the length field to exceed the expected structure size, the attacker can manipulate the stack memory of the system during the upgrade process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSarm-trusted-firmwareno fix listedUBUNTU-CVE-2025-53022
Ubuntu:24.04:LTSarm-trusted-firmwareno fix listedUBUNTU-CVE-2025-53022
Ubuntu:25.10arm-trusted-firmwareno fix listedUBUNTU-CVE-2025-53022
Ubuntu:26.04:LTSarm-trusted-firmwareno fix listedUBUNTU-CVE-2025-53022
Ubuntu:26.10arm-trusted-firmwareno fix listedUBUNTU-CVE-2025-53022

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References