EUVD-2026-85925
GHSA-4g6r-fwpq-m2vw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain privileged normal-world access on HPS
-
DeliveryIssue crafted secure-monitor call to TF-A
-
ExploitTrigger out-of-bounds read past buffer bound
-
ExecutionCorrupt secure-world memory / leak data
-
ImpactEscalate into secure monitor
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access with high privileges (PR:H) on the normal-world OS of an Altera Trusted Firmware (TF-A) deployment on a socfpga Hard Processor System, running a version through socfpga_v2.14.0. The attacker must be able to invoke secure-monitor calls into the secure world to reach the vulnerable out-of-bounds read; there is no network vector and no user interaction. Limiting factors: exploitation is gated by already holding privileged execution on the device, it is local-only (not remotely reachable), and it targets a specific FPGA-SoC firmware component rather than general-purpose software, which sharply narrows the exposed population. |
| Impact | This is a genuine but access-gated firmware flaw, not an internet-facing crisis. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) confirms local-only exploitation requiring high privileges - an attacker must already hold a privileged position in the normal-world OS running on the Altera/Intel socfpga Hard Processor System (HPS) to reach ARM Trusted Firmware (TF-A) via secure-monitor calls. The real value is the trust-boundary crossing: subsequent-system impacts (SI:H/SA:H) reflect that a CWE-125 out-of-bounds read in the secure monitor can enable privilege escalation and buffer-overflow corruption from the normal world into the secure world, hence the 8.3 (HIGH) score despite the local vector. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, and the exploitation status is 'no public exploit identified at time of analysis.' The high PR:H barrier plus local-only access means this is realistically a defense-in-depth / supply-chain integrity concern for FPGA-SoC deployments rather than a mass-exploitation priority. Note the primary CWE is an out-of-bounds READ (CWE-125), yet the description and tags also claim privilege escalation and buffer overflow - the write/corruption pathway is asserted by the vendor but not detailed, so the escalation mechanism should be verified against Altera advisory asa-0006. |
| Exploit ScenarioDerived | An attacker who has already gained privileged (e.g. kernel/root) code execution on the normal-world OS of an Altera socfpga HPS device issues a crafted secure-monitor call whose parameters drive the Trusted Firmware into an out-of-bounds read. By manipulating the miscalculated buffer boundary, the attacker corrupts secure-world memory to leak data or escalate into the secure monitor, crossing the normal-to-secure trust boundary. No public proof-of-concept is identified at time of analysis; exploitation requires local privileged access, not remote reach. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Local privilege escalation in Altera Trusted Firmware (TF-A) on socfpga Hard Processor Systems lets an attacker who already holds high privileges on the normal-world OS drive an out-of-bounds read inside the secure monitor, exposing and corrupting secure-world memory and escalating execution context, in all versions through socfpga_v2.14.0. The flaw is reachable only by invoking secure-monitor calls from an already-privileged local context, with no network vector and no user interaction, but because it crosses the normal-world/secure-world boundary it yields high integrity and availability impact beyond the vulnerable component (CVSS 4.0 base 8.3; independent assessment CVSS 3.1 8.3). No public exploit code has been identified and the issue is not listed in CISA KEV, so exposure is confined to devices where an adversary has already achieved privileged local execution.
RemediationAI
The provided data identifies no exact patched version, so the primary action is to obtain the fixed TF-A release from Altera security advisory ASA-0006 (https://www.altera.com/product-security/advisory/asa-0006) and update any socfpga firmware baseline at or below socfpga_v2.14.0 to the vendor-designated correction; do not assume a specific version number that is not stated in the advisory. Until that update is applied, treat the secure-monitor interface as an attack surface reachable only by privileged local code and reduce the population of principals that can reach it: restrict root and kernel-level access on the HPS normal-world OS so that only trusted, integrity-verified images can issue SMC calls, and remove or disable vendor-supplied debug, diagnostic, or manufacturing services that proxy privileged requests into the secure world (trade-off: this can break field diagnostics and provisioning workflows). Where the platform permits it, enable secure boot and image authentication so a tampered normal-world OS cannot be used to reach the vulnerable path, and enable any available firmware-level logging of anomalous SMC parameters to detect probing (trade-off: secure boot locks out unsigned development builds and logging consumes secure-world resources). Because exploitation is gated by pre-existing high privilege and is local-only, isolating physical and administrative access to affected devices, and monitoring for privilege-escalation activity on the HPS OS, are effective interim compensating controls while the firmware update is qualified and rolled out; note that none of these workarounds remove the underlying out-of-bounds read, so the vendor firmware fix remains the only complete remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is ARM Trusted Firmware-A (TF-A) as shipped by Altera for the Hard Processor System (HPS) in its SoC FPGA families, tracked by the CPE cpe:2.3:a:altera:trusted_firmware:*:*:*:*:*:*:*:*, which covers all releases through socfpga_v2.14.0. TF-A implements the secure monitor (BL31) that runs at the highest Arm exception level and exposes a Secure Monitor Call (SMC) interface to the normal world; the HPS normal-world OS and its privileged components use those calls to reach secure services. CWE-125 (out-of-bounds read) indicates the root cause is a missing or insufficient bounds check on an attacker-influenced index, length, or descriptor passed across that SMC boundary, so a malformed call causes firmware to read past the end of an intended buffer. Unlike a pure information-disclosure bug, the vendor description also flags buffer overflow and privilege escalation, meaning the out-of-bounds read corrupts or misdirects subsequent buffer handling and lets the caller manipulate secure-world state. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, with VI:H/VA:H and scope-changed SI:H/SA:H) and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) both describe a local, high-privilege, no-interaction attack whose impact extends into the secure world rather than a remotely reachable memory-safety defect.
Know when Trusted Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
Local secure-monitor call needing privileged normal-world access (AV:L, PR:H); scope changes as it crosses into the secure world (S:C) with limited read (C:L) but high integrity/availability corruption.
Primary rating from Vendor (Altera).
CVSS VectorVendor: Altera
DescriptionCVE.org
Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.
This issue affects Trusted Firmware: through socfpga_v2.14.0.
Executive ViewAI
Altera's Trusted Firmware for socfpga Hard Processor Systems carries a high-severity privilege-escalation flaw (CVSS 8.3) that lets an attacker who has already seized control of a device's main operating system cross into the secure execution environment that safeguards boot integrity, cryptographic keys, and device identity. No vendor-released patch has been identified, so organizations fielding this firmware in industrial, networking, or other embedded fleets face a gap in the hardware root of trust that routine patch cycles cannot close. Leadership should care because a breached secure world can persist undetected and undermine secure-boot and attestation guarantees across an entire device population, even though exploitation requires pre-existing privileged local access, there is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict least privilege and remove unnecessary privileged accounts on the normal-world OS; restrict local, debug, and physical interfaces (JTAG, serial, engineering ports) to authorized personnel; monitor for anomalous privileged activity and unexpected secure-monitor interactions; keep cryptographic keys and attestation material in hardware-backed storage de-linked from the affected firmware path; and segment or isolate units that cannot be updated until Altera publishes a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Trusted Firmware
View allA stack-based buffer overflow in Altera Trusted Firmware (the ARM Trusted Firmware-A port for Altera/Intel SoC FPGA Hard
Local, high-privileged attackers who can invoke the ARM Trusted Firmware secure-monitor interface on Altera SoCFPGA Hard
Privileged local code running in the non-secure world of an Altera SoC FPGA HPS device can make Altera Trusted Firmware
Out-of-bounds read in Altera Trusted Firmware for SoCFPGA hard processor systems (all builds through socfpga_v2.14.0) le
Privilege-gated out-of-bounds write in Altera Trusted Firmware (the SoCFPGA port of ARM Trusted Firmware-A) through socf
Buffer overflow in Altera Trusted Firmware (ARM Trusted Firmware-A) running on the Hard Processor System (HPS) of socfpg
A stack-based buffer overflow in Altera's Trusted Firmware port for SoC FPGA devices (the SoCFPGA branch through socfpga
Exploit-DB