An unchecked SDM mailbox response handler in the Altera Trusted Firmware allows an untrusted pointer dereference. This flaw enables an attacker to overwrite data in the EL3 secure memory space, undermining the integrity of privileged firmware. The core weakness is a lack of bounds checking on mailbox response addresses, which is a classic unchecked write vulnerability (CWE-822).

Altera Trusted Firmware version socfpga_v2.14.0 running on the HPS subsystem of supported SoC FPGA devices is affected. Any installation utilizing this firmware version is potentially vulnerable until the vendor releases an update.

The CVSS score of 8.3 indicates high severity. With an EPSS score of less than 1% the likelihood of exploitation is currently low but not negligible, and the flaw is not listed in the CISA KEV catalog. The flaw occurs within the SDM mailbox response handling code, so based on the description it is inferred that exploitation requires access to the mailbox interface on the HPS, typically local to the firmware or obtainable by a privileged attacker with physical or firmware-level control.