Altera Trusted Firmware EUVD-2026-85926

Requires local access to the FPGA SoC's hard processor system with already-high privileges (PR:H) in the normal world - i.e., the attacker must hold privileged/root-level code execution on the HPS before targeting the Trusted Firmware secure monitor. No user interaction is needed (UI:N) and no special attack requirement applies (AT:N), but exploitation is fundamentally gated by the local high-privilege precondition and by running an affected Trusted Firmware build (socfpga through v2.14.0). This is a normal-world-to-secure-world escalation, not a remote or pre-authentication vector; the HPS itself must be physically/logically reachable and already partly compromised.

This is a genuine but access-limited priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) confirms exploitation is LOCAL and requires HIGH privileges - an attacker must already have privileged code execution on the HPS (ARM Cortex-A cores of the socfpga SoC), so this is a normal-world→secure-world (TF-A/BL31 secure monitor) trust-boundary crossing, not a remote or unauthenticated flaw. The high 8.3 score is driven by the subsequent-system integrity/availability impacts (SI:H/SA:H, VI:H/VA:H) reflecting compromise of the secure monitor, but confidentiality is only Low (VC:L/SC:L), consistent with an out-of-bounds READ. No EPSS score, no CISA KEV listing, and no public POC are present in the data, so there is no evidence of active or automatable exploitation - the low prevalence of the product and the PR:H local prerequisite make widespread opportunistic attacks unlikely. Note a signal inconsistency worth flagging: CWE-119/the description characterize this as an out-of-bounds READ, yet the tags and title also say 'Overflow Buffers' and 'Privilege Escalation'; the achievable outcome (info leak vs. full secure-world code execution) is not fully pinned down by the available data and should be verified against Altera advisory asa-0006.

An attacker who has already gained privileged (root/EL1) code execution in the normal-world OS running on the FPGA SoC's hard processor system issues a crafted request to the Trusted Firmware secure monitor, triggering an out-of-bounds read in BL31 that corrupts or leaks secure-world state and enables escalation across the secure trust boundary. Exploitation is entirely local and requires high privileges; no public exploit code is identified at time of analysis.