CVE-2020-16273

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-12 · updated 2026-06-17
Weakness: CWE-191

Description

In Arm software implementing the Armv8-M processors (all versions), the stack selection mechanism could be influenced by a stack-underflow attack in v8-M TrustZone based processors. An attacker can cause a change to the stack pointer used by the Secure World from a non-secure application if the stack is not initialized. This vulnerability affects only the software that is based on Armv8-M processors with the Security Extension.

Affected products

Armv8-M Firmware: all versions

References

https://developer.arm.com/support/arm-security-updates/armv8-m-stack-sealing
https://developer.arm.com/support/arm-security-updates/armv8-m-stack-sealing

Get alerted when CVE-2020-16273 or the next vulnerability affects your stack