CVE-2024-0151: Arm v8-M Security Extensions Requirements On Development Tools

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains that implement 'Arm v8-M Security Extensions Requirements on Development Tools' prior to version 1.4, allows an attacker to pass values to Secure state that are out of range for types smaller than 32-bits. Out of range values might lead to incorrect operations in secure state.

Affected products

• Arm Arm v8-M Security Extensions Requirements On Development Tools: from 1.0, before 1.4 (fixed in 1.4)
• Arm ARMV8-M: from 1.0, before 1.4 (fixed in 1.4)

Published 2024-04-24. Last modified 2026-06-17.