Microchip SAMA5D4 CVE-2026-18349

Physical proximity to the target hardware is mandatory (AV:P); remote exploitation is not possible. The attacker must have access to the device's power supply or clock lines, typically requiring opening the device enclosure and attaching probes or hardware implants. High attack complexity (AC:H) means specialized fault injection equipment, precise timing knowledge of the target's boot or cryptographic routines, and iterative calibration are required - exploitation is not automated or trivially repeatable without device-specific profiling. No prior authentication or software privileges are required (PR:N) once physical access is achieved. Exploitation is most impactful when the SAMA5D4 is used as a root of trust (secure boot, key storage), as compromising that role undermines all higher-layer security guarantees. Devices with intact physical tamper protection, debug port lockdown, or voltage/frequency anomaly detection hardware limit exploitation feasibility.

Real-world risk is substantially constrained by the physical access requirement (AV:P) and high attack complexity (AC:H). Exploitation requires specialized glitching hardware, oscilloscopes or FPGAs for timing calibration, and considerable expertise in fault injection techniques - this is not a script-kiddie attack surface. The CVSS 4.0 score of 7.3 reflects this: despite all-high vulnerable-system and subsequent-system impacts, the physical and complexity barriers keep the score out of the critical tier. No CISA KEV listing and no public POC corroborate the assessment that this is currently a targeted, nation-state or sophisticated hardware lab-level threat rather than a broadly opportunistic one. The elevated subsequent-system impact metrics (SC:H/SI:H/SA:H) are significant: if the SAMA5D4 acts as a root of trust for a larger platform, compromising it cascades to all software and data it protects. Defenders should prioritize physical security of devices over remote patch urgency. Missing data: no patched hardware revision or firmware mitigation version is identified from the reference.

An attacker with physical access to a product built on the SAMA5D4 - such as an industrial controller or IoT gateway - connects a voltage glitching rig (e.g., a ChipWhisperer or custom FPGA-based tool) to the power rails, then sends precisely timed transient faults during the secure boot signature verification routine. The fault causes the processor to skip or corrupt the conditional branch that checks the signature result, allowing unsigned or malicious firmware to be accepted as authentic and executed with full privileges. No public POC has been identified, but the attack methodology is well-documented in academic fault injection literature and is within reach of a determined hardware attacker.