The vulnerability arises from an incorrect calculation of buffer size within the Trusted Firmware on the HPS platform. The flaw permits an overflow during VAB authentication, which may corrupt memory and enable arbitrary code to be executed, corresponding to CWE‑131.

Systems running Altera Trusted Firmware up through socfpga_v2.14.0 on Arm‑based HPS devices remain vulnerable; any deployment of these firmware versions should be reviewed against the Altera advisory.

The CVSS score of 8.3 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so no public exploitation has been reported. The likely attack vector is local or requires privileged access, inferred from the buffer‑overflow context, as the description does not specify an external entry point. Until a proof‑of‑concept is released, the exploitation risk remains theoretical, underscoring the need for timely remediation.