Caliptra Core ROM CVE-2026-11835

Q: What is the CVSS score of CVE-2026-11835?

CVE-2026-11835 has a CVSS 4.0 base score of 5.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-52549 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-08-04 Caliptra

Authentication Bypass Core Rom Caliptra

5.7

CVSS 4.0 · Vendor: Caliptra

Severity by source

Vendor (Caliptra) PRIMARY

5.7 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Local vector; high complexity TOCTOU timing window; high privilege (compromised MCU firmware required); scope change reflects attestation subsystem being deceived, affecting dependent consumers.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (Caliptra).

CVSS VectorVendor: Caliptra

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 03, 2026 - 16:52 NVD

5.6 (MEDIUM) 5.7 (MEDIUM)

Analysis Generated

Aug 04, 2026 - 00:30 vuln.today

DescriptionCVE.org

Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra.

This issue affects Core ROM: 2.1.0 through 2.1.1.

AnalysisAI

Secure boot bypass in Caliptra Core ROM 2.1.0-2.1.1 (subsystem mode) enables a local attacker controlling compromised MCU firmware to silently load unauthorized firmware into ICCM while attestation continues reporting the originally verified image digest, masking the compromise entirely. The TOCTOU race in UpdateResetFlow::run() is compounded by absent validation of the caller-supplied AXI staging address against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, creating a window between verification and ICCM load during which SRAM contents can be swapped. No public exploit has been identified and no CISA KEV listing applies, but the severity lies in the attack's undetectability through standard attestation channels.

Technical ContextAI

Caliptra is an open-source silicon Root of Trust (RoT) specification from the CHIPS Alliance, implemented as a hardware IP block used in data-center custom ASICs. The ROM firmware executes during update-reset sequences and, in subsystem mode, accepts firmware staging addresses from an external MCU over an AXI bus interface. The root cause (CWE-367: Time-Of-Check Time-Of-Use) emerges because UpdateResetFlow::run() verifies firmware integrity at an MCU-supplied AXI staging address without first validating that address against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR. Because the staging area resides in unprotected SRAM accessible by the AXI manager on the MCU, a compromised MCU can overwrite that SRAM window between the ROM's verification pass (check) and its subsequent ICCM load operation (use). The Internal Code and Constant Memory (ICCM) then receives attacker-controlled firmware. Critically, Caliptra's attestation subsystem binds its reported measurement to the pre-swap verified digest, so any downstream attestation consumer sees a clean measurement despite the loaded firmware being malicious. CPE: cpe:2.3:a:caliptra:core_rom:*:*:*:*:*:*:*:* covering versions 2.1.0 through 2.1.1.

RemediationAI

Consult GitHub Security Advisory GHSA-49mm-5gq5-v97f (https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-49mm-5gq5-v97f) for the authoritative patched version - an exact fix release was not independently confirmed from the data available at time of analysis. The correct fix must enforce that the MCU-supplied AXI staging address is validated against SS_EXTERNAL_STAGING_AREA_BASE_ADDR before any verification step, and must re-validate or atomically bind the staging address between verification and ICCM load to close the TOCTOU window. As a compensating control where ROM upgrade is not immediately possible, platforms should enforce hardware-enforced memory protection on SRAM regions used as staging areas (e.g., via Memory Protection Units or AXI firewall rules) to prevent MCU write access to those regions after the firmware image has been placed and before Caliptra completes loading; note that this requires platform-level hardware configuration and must be validated to avoid disrupting legitimate update flows. Additionally, restrict MCU firmware update chains to cryptographically signed, vendor-verified images to reduce the likelihood of MCU compromise that would enable the prerequisite attack stage.