EUVD-2026-85929
GHSA-rp2j-q3xg-2qhf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain privileged code execution in normal-world OS
-
DeliveryInvoke secure-monitor service with crafted args
-
ExploitOverflow stack buffer in TF-A
-
ExecutionCorrupt secure-world memory protections
-
ImpactEscalate into trusted execution environment
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local, high-privileged access to a device running Altera Trusted Firmware (ARM TF-A) on an Altera/Intel socfpga Hard Processor System through socfpga_v2.14.0 - the attacker must already control the normal-world OS to reach the secure-monitor interface. Exploitation is gated by PR:H (privileged normal-world execution) and AV:L (no network/remote path); there is no user-interaction requirement (UI:N). The payoff is crossing the normal→secure trust boundary, so the meaningful limiting factors are the need for prior privileged foothold and physical/logical local access to the affected FPGA SoC. |
| Impact | This is a genuine but access-gated firmware vulnerability rather than an internet-facing emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) confirms local exploitation requiring high privileges - an attacker must already be executing code in the normal (non-secure) world of the socfpga HPS to reach the Trusted Firmware-A secure monitor. Its practical value is the boundary crossing: subsequent-system impact VI:H/VA:H/SI:H/SA:H indicates a stack-based buffer overflow in the secure monitor that can corrupt the trusted execution environment, elevating from a compromised OS into TF-A (the root of trust). No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so this is not confirmed exploited - the risk is elevation potential, not mass exploitation. Note the score gap: the vendor's 4.0 rating of 8.3 reflects the security-domain crossing, whereas a CVSS 3.1 mapping (S:C/C:L/I:H/A:H) lands near 7.5; both agree on HIGH severity driven by integrity/availability of the secure world, with low confidentiality. The PR:H prerequisite is the primary risk-limiting factor. |
| Exploit ScenarioDerived | An attacker who has already gained privileged code execution in the normal-world OS running on an Altera/Intel socfpga HPS invokes a secure-monitor service with crafted parameters that overflow a stack buffer in Altera Trusted Firmware. By overwriting the saved return context they subvert TF-A's memory protections, gaining control or corrupting the secure world to defeat the device's root of trust. No public proof-of-concept is identified at time of analysis, and local privileged access is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
A stack-based buffer overflow in Altera Trusted Firmware (the ARM Trusted Firmware-A port for Altera/Intel SoC FPGA Hard Processor Systems) through socfpga_v2.14.0 lets a high-privileged local attacker corrupt a fixed-size stack buffer inside the secure monitor and cross the normal-world-to-secure-world trust boundary. The attacker must already control the normal-world OS on the affected HPS device (CVSS vector PR:H, AV:L, UI:N), so this is an access-gated escalation primitive rather than a remotely reachable issue; the assessed impact is high integrity and availability loss with limited confidentiality exposure in the secure world (CVSS 8.3). No public exploit code has been identified at time of analysis, and no evidence of active exploitation was provided by the vendor or in the supplied intelligence.
RemediationAI
No vendor-released patch version was identified in the available data, so the immediate action is to obtain the fixed release and guidance directly from Altera Product Security Advisory ASA-0006 (https://www.altera.com/product-security/advisory/asa-0006) and treat any version above socfpga_v2.14.0 offered there as the remediation target - do not assume a specific version number until the advisory confirms it. Until patched firmware is available, the practical compensating controls are all about denying the prerequisite local privileged foothold: enforce least privilege and hardened OS configuration on the normal-world HPS image so that only trusted code runs at the privilege level needed to reach the secure-monitor interface, with the trade-off that any residual local root/admin compromise still leaves the secure world exposed; disable or physically secure JTAG and other debug interfaces on production boards, accepting reduced field-debug capability; and enforce authenticated/fused secure boot so a tampered normal-world image cannot be used as the delivery vehicle, at the cost of key-management overhead and bricking risk if keys are mishandled. Because exploitation requires local high-privileged access (PR:H, AV:L) and there is no network attack path, network segmentation and perimeter controls provide little benefit here; monitoring should instead focus on anomalous SMC invocation patterns and unexpected secure-monitor resets.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Trusted Firmware-A is ARM's reference secure-monitor implementation; on Altera/Intel SoC FPGAs it runs on the Hard Processor System (HPS) at the highest exception level and mediates services requested by the normal world (typically via SMC calls into BL31). The vulnerability is CWE-121, a stack-based buffer overflow, meaning a fixed-size stack buffer is written past its bounds - here characterized by Altera as exploitation of improperly configured or implemented memory protections, so the root cause combines missing or inadequate bounds checking with stack protections that do not prevent the overwrite. The CPE cpe:2.3:a:altera:trusted_firmware:*:*:*:*:*:*:*:* matches the product across versions, with the affected range bounded by the vendor to releases through socfpga_v2.14.0; because the secure monitor is the component corrupted, the security scope change (S:C in the assessed CVSS 3.1 vector) reflects potential compromise of code and data outside the vulnerable component's own authority - i.e., the secure world.
Know when Trusted Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
Local secure-monitor call needs prior high privilege (AV:L/PR:H); overflow crosses into the secure world (S:C) corrupting TF-A integrity/availability (I:H/A:H), limited info leak (C:L).
Primary rating from Vendor (Altera).
CVSS VectorVendor: Altera
DescriptionCVE.org
Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue affects Trusted Firmware: through socfpga_v2.14.0.
Executive ViewAI
Organizations using Altera/Intel SoC FPGA Hard Processor Systems with Altera Trusted Firmware through socfpga_v2.14.0 face a high-severity integrity and availability risk in the secure monitor. A local attacker who already controls the normal-world operating system could cross into the secure world, potentially undermining device trust and disrupting protected services. No public exploit code has been identified at time of analysis, but leadership should prioritize inventory and access controls because no vendor-released patch is currently available.
No vendor-released patch identified at time of analysis; restrict local privileged access to the normal-world OS, enforce least privilege, disable unnecessary debug/physical interfaces, monitor privileged activity for anomalous secure-monitor interactions, and isolate affected devices until a vendor patch or mitigation is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Trusted Firmware
View allLocal, high-privileged attackers who can invoke the ARM Trusted Firmware secure-monitor interface on Altera SoCFPGA Hard
Privileged local code running in the non-secure world of an Altera SoC FPGA HPS device can make Altera Trusted Firmware
Out-of-bounds read in Altera Trusted Firmware for SoCFPGA hard processor systems (all builds through socfpga_v2.14.0) le
Local privilege escalation in Altera Trusted Firmware (TF-A) on socfpga Hard Processor Systems lets an attacker who alre
Privilege-gated out-of-bounds write in Altera Trusted Firmware (the SoCFPGA port of ARM Trusted Firmware-A) through socf
Buffer overflow in Altera Trusted Firmware (ARM Trusted Firmware-A) running on the Hard Processor System (HPS) of socfpg
A stack-based buffer overflow in Altera's Trusted Firmware port for SoC FPGA devices (the SoCFPGA branch through socfpga
Exploit-DB