CVE-2026-58007: Unchecked SDM mailbox response address enables EL3 secure-memory corruption

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates local access and high privileges are required. No user interaction is required.

Q: What is the potential impact after successful exploitation?

Successful exploitation can corrupt secure memory at EL3. The reported impacts include high integrity and availability impact, low confidentiality impact, and a scope change.

Q: Which versions are known to be affected?

Altera Trusted Firmware is affected through socfpga_v2.14.0. The provided information does not identify a fixed version or a workaround.

Published Sep 24, 2026

Updated

Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.

This issue affects Trusted Firmware: through socfpgav2.14.0.

Affected Software

1 affected component

Altera Trusted Firmware<=socfpga_v2.14.0

Event History

Sep 24, 2026

CVE Published

via MITRE·02:52 PM

Data Sourced

via MITRE·02:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates local access and high privileges are required. No user interaction is required.

What is the potential impact after successful exploitation?

Successful exploitation can corrupt secure memory at EL3. The reported impacts include high integrity and availability impact, low confidentiality impact, and a scope change.

Which versions are known to be affected?