CVE-2021-27562VulnerabilityPublished 11/03/2021Updated 10/24/2026
CVE-2021-27562: Arm Trusted Firmware Out-of-Bounds Write Vulnerability
Affects Arm Trusted FirmwareSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 11/03/2021
- KEV deadline
- 11/17/2021
- EPSS
- 3.1% chance of exploitation in 30 days – higher than 87% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
CVE-2021-27562 is an out-of-bounds write vulnerability in Arm Trusted Firmware that allows the non-secure world to cause a system halt, overwrite secure data, or leak secure data by invoking secure functions under the non-secure processing environment handler mode. It affects Yealink Device Management servers. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.