CVE-2020-16273

7.8 highEPSS 0.3%

High (7.8) in arm armv8-m firmware. EPSS 0.3% chance of exploitation in the next 30 days.

In Arm software implementing the Armv8-M processors (all versions), the stack selection mechanism could be influenced by a stack-underflow attack in v8-M TrustZone based processors. An attacker can cause a change to the stack pointer used by the Secure World from a non-secure application if the stack is not initialized. This vulnerability affects only the software that is based on Armv8-M processors with the Security Extension.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE: CWE-191
Published: 2020-11-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

arm:armv8-m_firmware

References

https://developer.arm.com/support/arm-security-updates/armv8-m-stack-sealing
https://developer.arm.com/support/arm-security-updates/armv8-m-stack-sealing

Check your stack JSON