This vulnerability involves information exposure via microarchitectural state after transient execution on the nRF5340 device. Specifically, any application that uses external QSPI flash for encrypted XIP and depends on that encryption for protecting the confidentiality or integrity of code stored externally is affected. The issue stems from the on-the-fly decryption mechanism, not from any particular version of the nRF Connect SDK. The CVSS 4.0 score is 6.8, indicating a medium severity with attack vector physical, high attack complexity, and partial impact on confidentiality, integrity, and availability.

The vulnerability allows potential exposure of sensitive information from the microarchitectural state after transient execution, which could undermine the confidentiality and integrity guarantees of the encrypted external code stored on QSPI flash. This could lead to unauthorized disclosure of code or data that applications rely on for security. However, exploitation requires physical access and has high complexity, limiting the practical impact.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should consider the risk of physical access attacks and evaluate the necessity of relying solely on the on-the-fly decryption scheme for protecting external code confidentiality and integrity.