A crafted oversized firmware image triggers an out‑of‑bounds read during VAB authentication in Altera Trusted Firmware, causing a stack overflow in EL3. The flaw gives an attacker the ability to execute arbitrary code with elevated privileges, potentially compromising the entire system’s confidentiality, integrity, and availability. The vulnerability is identified as CWE‑125, indicating improper bounds checking of memory access.

Altera Trusted Firmware, version socfpga_v2.14.0, installed on Altera SoC FPGA platforms. No other versions are mentioned in the advisory.

The CVSS score of 8.3 reflects high severity. EPSS data is unavailable, so the likelihood of exploitation is uncertain, but the lack of a KEV listing implies no confirmed widespread exploitation yet. The attack likely requires delivery of a malicious firmware image through the firmware update mechanism, so local or privileged access to that interface is required. If the vulnerable firmware is deployed, the risk is significant as the flaw permits escalation of privilege and potential denial of service through stack corruption.