A stack-based buffer overflow in Altera Trusted Firmware on the HPS allows an attacker to corrupt data on the stack and potentially execute code at the EL3 privilege level. The vulnerability is caused by improper bounds checking in the processing of HKDF requests, and it maps to CWE‑121, which describes stack memory corruption. Compromise of this processor mode could lead to full control of the embedded system and compromise of all data and functions controlled by the firmware.

All Altera Trusted Firmware releases that include the socfpga_v2.14.0 firmware bundle are affected. The affected product is Trusted Firmware for SOCFPGA, version socfpga_v2.14.0, as specified by the vendor advisory. No other versions are listed as being impacted in the provided data.

The CVSS score of 8.3 indicates high severity. No EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalog, so publicly known exploitation activity is not documented. The likely attack vector is local or remote through an HPS-based interface that can trigger the HKDF processing routine. Because the failure occurs in the lowest privilege EL3 context, exploitation would grant the attacker full control over the device. The risk is significant for any deployment that relies on the affected firmware and does not mitigate the buffer overflow via software or configuration changes.