Altera Trusted Firmware EUVD-2026-85927

Requires the attacker to already possess high privileges (PR:H) with local access (AV:L) in the normal/non-secure world of an Altera socfpga HPS device running Trusted Firmware at or below socfpga_v2.14.0; exploitation then abuses a firmware code path that dereferences an attacker-supplied pointer where memory protections are improperly configured or implemented. Limiting factors: no remote vector, no unauthenticated path, and no user interaction is involved - but the pre-requisite privileged foothold on the embedded SoC substantially narrows the realistic attacker set to those who have already compromised the running system or supply chain.

This is a genuinely serious flaw within its narrow scope but not a broad-fleet emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) shows the core limiter clearly: exploitation is LOCAL and requires HIGH privileges (PR:H) - the attacker must already hold a privileged position in the normal-world (non-secure) execution environment of the SoC before triggering the untrusted pointer dereference in the ARM Trusted Firmware secure monitor. What elevates severity is the scope/trust-boundary crossing: subsequent-system integrity and availability are High (SI:H/SA:H), reflecting that a normal-world compromise propagates into the secure firmware, with confidentiality only Low (VC:L/SC:L). There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data - so this is 'no public exploit identified at time of analysis,' not confirmed exploitation. Signals are internally consistent (no network-vs-local conflict), so the 8.3 is a defensible base score, but the PR:H + AV:L combination means real-world risk is confined to attackers who already have privileged code execution on the FPGA SoC. This is a high-value but low-likelihood, targeted/embedded-supply-chain concern rather than a mass-exploitation priority.

An attacker who has already gained privileged code execution in the normal world of an Altera/Intel socfpga HPS (e.g. a compromised OS/bootloader component) invokes a firmware interface that passes an attacker-controlled pointer, which the Trusted Firmware dereferences without validating it against secure memory protections. By steering that dereference the attacker corrupts or influences secure-world firmware state, crossing the normal→secure trust boundary to gain integrity/availability impact over the secure monitor. No public POC or exploit code is identified in the available data.