High severity · published Sep 24, 2026
CVE-2026-58007
Unchecked SDM mailbox response address enables EL3 secure-memory corruption
8.1
CVSS
0.1%
EPSS
No
On KEV
Description
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue affects Trusted Firmware: through socfpga_v2.14.0.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Trusted Firmware · Altera
through socfpga_v2.14.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58007
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58007
www.altera.com
https://www.altera.com/product-security/advisory/asa-0006
More from Trusted Firmware
8.1
CVE-2026-58008
Unchecked HKDF key-size input in EL3 causes a stack buffer overflow
8.1
CVE-2026-58006
Altera SoCFPGA BL31 Mailbox Output Pointer Validation Enables EL3 Secure-Memory Corruption
8.1
CVE-2026-58005
Unvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3.
8.1
CVE-2026-58004
Crafted oversized firmware image causes EL3 stack overflow during VAB authentication on Trusted Firmware.
8.1
CVE-2026-13467
Systemic Missing Address Validation in SiP SMC Handlers