This vulnerability is an out‑of‑bounds write in the SiP SMC handlers of Altera Trusted Firmware. The flaw allows an attacker who can trigger the faulting handler to corrupt memory, which can lead to exploitation of improperly configured or implemented memory protections. The weakness is a classic example of CWE‑787: Out‑Of‑Bounds Write, directly compromising data integrity and potentially enabling further exploitation.

The issue affects Altera’s Trusted Firmware on the HPS subsystem, specifically version socfpga_v2.14.0. Users running this firmware on their SoC platforms are susceptible, while later versions that incorporate the vendor’s fix should no longer be vulnerable.

The CVSS score of 8.3 signals high severity, but the EPSS score is not available, making it uncertain how frequently the vulnerability is currently exploited. The flaw is not listed in CISA’s KEV catalog, indicating it may not be a known target yet. However, the lack of memory protection suggests that an attacker could gain extensive control if the flaw is triggered. The likely attack vector is through the SMC interface, which requires an attacker to be able to invoke the handler, a scenario that could arise from a privileged or compromised software component.