Altera Trusted Firmware EUVD-2026-85923

Requires local access (AV:L) to an Altera/Intel FPGA SoC running Trusted Firmware on the Hard Processor System, with the attacker already holding high privileges (PR:H) - i.e. privileged normal-world code execution able to reach the firmware's service interface. No user interaction is required (UI:N). Exploitation is limited to devices running the affected TF-A branch through socfpga_v2.14.0; it is not remotely reachable and not triggerable by an unprivileged user, which substantially constrains real-world exposure to post-compromise privilege/trust escalation on the specific embedded hardware.

This is a locally-exploitable, high-privilege memory-safety flaw (CWE-131 incorrect buffer-size calculation) in Altera Trusted Firmware (ARM TF-A) running on the Hard Processor System of socfpga FPGA SoCs. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) rates it 8.3 (High), driven not by the base vulnerable-system impact (VC:L/VI:H/VA:H) but by high subsequent-system integrity and availability (SC:L/SI:H/SA:H) - indicating the overflow can cross a privilege/trust boundary from an already-privileged normal-world context into the secure firmware, which is the core danger of a TF-A bug. The AV:L requires the attacker to already be executing on the device with high privileges (PR:H), which strongly limits opportunistic mass exploitation and points to a local escalation-of-trust primitive rather than a remote worm. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active or automatable exploitation. Net assessment: a genuinely serious flaw within its trust model (secure-monitor integrity/availability), but real-world urgency is bounded by the local + high-privilege prerequisites and the niche embedded footprint; treat as a firmware-patch priority for affected Altera/Intel FPGA-SoC deployments rather than an internet-facing emergency. Note: no separate NVD-provided CVSS 3.1 vector was supplied - only the vendor 4.0 vector - so cross-framework comparison is limited to the vendor data.

An attacker who already has high-privilege code execution on the FPGA SoC's normal-world OS (e.g. a compromised privileged process or a malicious kernel-level component) invokes a firmware service and supplies input that triggers the miscalculated buffer size in Trusted Firmware, overflowing a buffer inside the secure monitor. This corrupts secure-world state to tamper with or crash trusted firmware, escalating from the already-privileged normal world into the secure boundary. No public exploit code is identified at time of analysis, and the local, high-privilege prerequisites make this a targeted post-compromise escalation rather than a drive-by attack.