CVE-2026-13467: Systemic Missing Address Validation in SiP SMC Handlers

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is locally exploitable and requires high privileges. No user interaction is required.

Q: What could successful exploitation affect?

The reported CVSS vector indicates low confidentiality impact and high integrity and availability impact. The scope is changed, meaning the impact can extend beyond the vulnerable component's original security authority.

Q: How can I determine whether a deployment is affected?

Altera Trusted Firmware versions through socfpga_v2.14.0 are identified as affected. Review the Trusted Firmware version deployed on the HPS.

Published Sep 24, 2026

Updated

Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.

This issue affects Trusted Firmware: through socfpgav2.14.0.

Affected Software

1 affected component

Altera Trusted Firmware<=socfpga_v2.14.0

Event History

Sep 24, 2026

CVE Published

via MITRE·02:51 PM

Data Sourced

via MITRE·02:51 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is locally exploitable and requires high privileges. No user interaction is required.

What could successful exploitation affect?

The reported CVSS vector indicates low confidentiality impact and high integrity and availability impact. The scope is changed, meaning the impact can extend beyond the vulnerable component's original security authority.

How can I determine whether a deployment is affected?