Introduction
If its security checks are flawed, a single firmware update can compromise the integrity of thousands of embedded devices. In CVE-2025-53022, a subtle oversight in TrustedFirmware-M's firmware upgrade process could let an attacker overwrite stack memory and potentially execute arbitrary code in a secure environment. TrustedFirmware-M (TF-M) is an open-source secure firmware project for ARM Cortex-M microcontrollers. It is widely adopted in IoT, industrial, and embedded systems as a reference implementation for secure boot, cryptographic services, and trusted execution environments. A consortium of companies including Arm, STMicroelectronics, and NXP maintains TF-M, and it underpins the security of millions of devices worldwide.
Technical Information
CVE-2025-53022 is a stack buffer overflow in the firmware upgrade (FWU) module of TrustedFirmware-M. It sits in the code that processes Type-Length-Value (TLV) structures in MCUBoot upgrade images. When the FWU module processes a new firmware image, it parses the TLV entries that describe dependent components. The vulnerable function, in tfm_mcuboot_fwu.c around line 257, does not check a TLV entry's length field against the size of the stack-allocated buffer meant to hold the TLV value.
If an attacker can supply a crafted MCUBoot upgrade image containing a TLV entry with an excessively large length field, the FWU module copies the TLV value into the buffer without a bounds check. The result is a classic stack buffer overflow (CWE-121), which can overwrite adjacent stack data, including return addresses or function pointers. Successful exploitation could lead to arbitrary code execution in TF-M's secure context, undermining the integrity of the secure boot process and of any service that relies on TF-M for isolation.
The flaw is exploitable only if the attacker can control the firmware upgrade image, which may be possible through a compromised supply chain or an insecure update mechanism.
The relevant code location is:
// tfm_mcuboot_fwu.c, around line 257 while (bootutil_tlv_iter_next(...)) { // No length check against buffer size if (bootutil_tlv_iter_get_value(...) == NULL) { return ...; } }
The official TrustedFirmware-M security advisory and the source code reference have further technical details.
Patch Information
In March 2025, Qualcomm released a security bulletin covering multiple vulnerabilities across its product line, including automotive systems, mobile chipsets, and networking devices. (securityweek.com) The critical issues included memory corruption flaws and improper input validation vulnerabilities that could let attackers execute arbitrary code or disrupt system operations.
Qualcomm's patches update the firmware and software components of the affected devices. They add stronger input validation to prevent improper data handling, and they improve memory management to address potential corruption.
For example, the patch for the memory corruption vulnerability CVE-2024-53012 changes the clock device driver to add stricter input validation and bounds checking. Data passed to the driver is now validated before processing, which is meant to prevent exploitation.
Similarly, CVE-2024-53022 involves memory corruption during communication between primary and guest virtual machines. Its patch updates the inter-VM communication protocols to validate messages exchanged between VMs more strictly, and adds checks against unauthorized access or data corruption.
Qualcomm has shared these patches with Original Equipment Manufacturers (OEMs) and strongly recommends that they deploy the updates to released devices promptly. Users should ask their device manufacturers whether the patches are available and apply them as soon as possible to protect their devices against these vulnerabilities.
Patch sources:
Affected Systems and Versions
CVE-2025-53022 affects TrustedFirmware-M versions before 2.1.3 and 2.2.x before 2.2.1. Any system or product that integrates TF-M in these version ranges is vulnerable, including embedded devices, IoT platforms, and industrial systems that rely on TF-M for secure boot and firmware updates. The vulnerability is present in configurations where the firmware upgrade (FWU) module processes MCUBoot images containing TLV entries for dependent components.
- Affected versions: TrustedFirmware-M before 2.1.3 and 2.2.x before 2.2.1
- Vulnerable component: Firmware Upgrade (FWU) module, TLV processing logic
Vendor Security History
TrustedFirmware-M has previously fixed vulnerabilities related to stack sealing and input validation, such as TFMV-1, along with other advisories. The project runs a public advisory process and typically releases patches promptly once a security issue is found. It handles vulnerabilities transparently and collaborates with industry partners, which reflects a mature security process.
