CVE-2026-58005: Unvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3.
Published Sep 24, 2026
·Updated
Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.
This issue affects Trusted Firmware: through socfpgav2.14.0.
Affected Software
1 affected component
Altera Trusted Firmware<=socfpga_v2.14.0
Event History
Sep 24, 2026
CVE Published
via MITRE·02:52 PM
Data Sourced
via MITRE·02:52 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need?
Exploitation requires local access and high privileges. No user interaction is required.
2
What is the potential impact after exploitation?
The issue can lead to privilege escalation, buffer overflow conditions, and compromise of confidentiality, integrity, and availability. The CVSS vector indicates the security scope can extend beyond the initially affected component.
3
Which deployments should be investigated?
Investigate systems using Altera Trusted Firmware on HPS, particularly deployments identified as affected through socfpga_v2.14.0. The provided information does not identify a fixed version or a configuration-based workaround.