Altera Trusted Firmware EUVD-2026-85928

Requires local, high-privilege access to the Altera socfpga Hard Processor System (HPS) - the attacker must already be able to invoke the ARM Trusted Firmware secure-monitor interface (e.g. via SMC calls) from a privileged normal-world context. Exploitation is limited by the need for prior privileged code execution on the device (PR:H, AV:L) and applies to Trusted Firmware builds through socfpga_v2.14.0; there is no remote or network-facing exposure and no user interaction is involved. The core condition is passing an attacker-controlled untrusted pointer into a secure-monitor handler that lacks proper memory-protection validation.

The Altera-supplied CVSS 4.0 base score of 8.3 is driven almost entirely by the scope/subsequent-system metrics (SI:H/SA:H) rather than by ease of access. The vector (AV:L/AC:L/AT:N/PR:H/UI:N) makes clear this is a LOCAL, HIGH-PRIVILEGE issue: an attacker must already hold privileged execution in the normal world (e.g. EL1/kernel or a privileged HPS context) to reach the Trusted Firmware secure monitor and trigger the untrusted pointer dereference (CWE-822). The value therefore lies in the normal-world → secure-world trust boundary crossing, not in remote reach. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' Net: this is a genuinely serious secure-firmware privilege-boundary flaw but NOT a mass-exploitation priority - it requires prior code execution on a specific Altera/Intel socfpga FPGA SoC, making it a targeted/embedded concern rather than a widespread one. Note also a labeling tension: the CVSS impact profile (VI:H/VA:H, VC:L) points to integrity/availability compromise of the secure world, while the 'Information Disclosure' tag emphasizes confidentiality - verify intent with the Altera advisory.

An attacker who has already achieved privileged (non-secure world) code execution on an Altera socfpga HPS device passes a crafted/untrusted pointer into a Trusted Firmware secure-monitor (SMC) handler, which dereferences it without proper memory-protection validation. This corrupts or leaks secure-world memory, letting the attacker undermine the secure/normal-world isolation boundary. No public exploit code is identified at time of analysis, and local high-privilege access is a prerequisite.