EUVD-2026-85924
GHSA-mmg6-7x75-gq2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged access on HPS normal world
-
DeliveryInvoke vulnerable Trusted Firmware interface
-
ExploitTrigger out-of-bounds write past memory protections
-
ExecutionCorrupt secure-world firmware state
-
ImpactCompromise platform root of trust
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to an Altera SoCFPGA Hard Processor System (HPS) running the Trusted Firmware (ARM TF-A) port at or below socfpga_v2.14.0, plus high privileges (PR:H) - i.e., the attacker must already hold privileged execution in the normal world to reach the vulnerable secure-firmware code path that has improperly configured/implemented memory protections. No user interaction is needed. Limiting factors: the attack vector is LOCAL (not network-reachable), high privilege is a hard prerequisite, and only Altera/Intel SoC FPGA platforms running this specific TF-A build are affected - general-purpose or non-FPGA systems are unaffected. |
| Impact | This is a genuine but access-gated firmware integrity issue rather than a mass-exploitable remote threat. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) confirms exploitation requires LOCAL access AND high privileges - an attacker must already have privileged code execution in the normal world (or equivalent) on the Altera HPS to reach the vulnerable Trusted Firmware code path. The 8.3 (HIGH) score is driven by the security-boundary crossing: an OOB write in TF-A can corrupt secure-world state (VI:H/VA:H, SI:H/SA:H, SC:L subsequent-system impact), effectively undermining the platform root of trust. No EPSS score, no CISA KEV listing, and no public exploit were provided - exploitation status is 'no public exploit identified at time of analysis.' The high privilege requirement plus local-only vector means this is a targeted, post-compromise or supply-chain/insider-class risk, not an internet-facing priority. Net: prioritize for affected SoCFPGA deployments where firmware integrity is a trust anchor, but it is not a drop-everything remote CVE. |
| Exploit ScenarioDerived | An attacker who has already gained privileged code execution on the normal-world OS of an Altera SoCFPGA Hard Processor System invokes the vulnerable Trusted Firmware interface with crafted parameters, triggering an out-of-bounds write past intended memory-protection boundaries. This corrupts secure-firmware memory, allowing tampering with or crashing the trusted execution environment and undermining the platform's secure boot/root-of-trust guarantees. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Privilege-gated out-of-bounds write in Altera Trusted Firmware (the SoCFPGA port of ARM Trusted Firmware-A) through socfpga_v2.14.0 allows an attacker who already holds high privileges in the normal world to corrupt memory in the secure firmware, degrading the integrity and availability of the trusted execution environment and extending the scope of compromise beyond the attacker's original context. The root cause is an improperly configured or implemented memory protection (CWE-787) that is reachable only from a local, already-privileged position on Altera/Intel SoC FPGA Hard Processor System platforms, so it is not remotely reachable and does not affect general-purpose systems; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).
RemediationAI
No exact fixed release or patch version is provided in the available intelligence, so treat this as "No vendor-released patch identified at time of analysis" and confirm current fix status directly in Altera advisory ASA-0006 (https://www.altera.com/product-security/advisory/asa-0006) before planning a rollback or upgrade; once Altera publishes a build above socfpga_v2.14.0, updating the HPS Trusted Firmware image and re-signing/re-flashing the boot chain is the primary fix. Because exploitation requires local, already-high-privileged access, the most effective compensating controls reduce that precondition: restrict interactive and privileged access to the HPS normal world (harden OS accounts, disable unnecessary root/sudo paths, enforce least privilege for services that can issue SMC calls), and lock down debug paths by fusing off JTAG/secure debug in production parts, accepting that this removes field debugging and recovery options. Keep normal-world software patched and monitor for prior compromise, since this flaw amplifies an existing foothold rather than providing initial access, and note that network-layer controls such as firewalls or port blocking are of limited value against a purely local attack vector.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Altera's Trusted Firmware, the vendor port of ARM Trusted Firmware-A (TF-A) that runs at the highest exception level (EL3) on the Hard Processor System of Altera/Intel SoC FPGAs and is responsible for secure boot, secure monitor services and the isolation boundary between the normal world and the secure world. The CPE cpe:2.3:a:altera:trusted_firmware:*:*:*:*:*:*:*:* confirms the vulnerable artifact is the firmware itself, with all builds up to and including socfpga_v2.14.0 in range. The weakness class is CWE-787 (out-of-bounds write) occurring in a region where memory protections are improperly configured or implemented, meaning the misplaced write is not contained by the expected stage-1/stage-2 translation or memory-firewall policy of the secure firmware. Because the vulnerable code path is only reachable from the normal world by a caller that already possesses high privilege (PR:H in the provided vector) and the attack surface is local (AV:L), this is a post-compromise integrity and availability problem rather than a remote entry point; the assessed scope change (S:C) reflects that the impact is not confined to the initially compromised normal-world component but extends into the trusted firmware's security boundary.
Know when Trusted Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
Local, high-privilege prerequisite (PR:H/AV:L); OOB write in trusted firmware crosses the secure boundary (S:C) with strong integrity/availability and limited confidentiality impact.
Primary rating from Vendor (Altera).
CVSS VectorVendor: Altera
DescriptionCVE.org
Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue affects Trusted Firmware: through socfpga_v2.14.0.
Executive ViewAI
Altera/Intel SoC FPGA Hard Processor System platforms running Altera Trusted Firmware through socfpga_v2.14.0 are exposed to a high-severity flaw that could let an already highly privileged local actor corrupt secure-firmware memory and weaken the trusted execution environment. Because this occurs after an attacker has gained a strong foothold in the normal world, the primary business concern is containment: a compromised embedded or edge device could expand an intrusion beyond its original boundary and undermine secure-boot or trusted-processing assurances. Leadership should prioritize affected deployments where local privileged access is plausible, even though there is no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include restricting local high-privilege access to affected HPS platforms, enforcing least privilege in the normal world, disabling unused debug/JTAG interfaces, isolating affected devices on trusted network segments, monitoring secure-firmware integrity and availability, and applying vendor guidance or fixed firmware as soon as Altera/Intel releases it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Trusted Firmware
View allA stack-based buffer overflow in Altera Trusted Firmware (the ARM Trusted Firmware-A port for Altera/Intel SoC FPGA Hard
Local, high-privileged attackers who can invoke the ARM Trusted Firmware secure-monitor interface on Altera SoCFPGA Hard
Privileged local code running in the non-secure world of an Altera SoC FPGA HPS device can make Altera Trusted Firmware
Out-of-bounds read in Altera Trusted Firmware for SoCFPGA hard processor systems (all builds through socfpga_v2.14.0) le
Local privilege escalation in Altera Trusted Firmware (TF-A) on socfpga Hard Processor Systems lets an attacker who alre
Buffer overflow in Altera Trusted Firmware (ARM Trusted Firmware-A) running on the Hard Processor System (HPS) of socfpg
A stack-based buffer overflow in Altera's Trusted Firmware port for SoC FPGA devices (the SoCFPGA branch through socfpga
Exploit-DB