Caliptra Core Firmware CVE-2026-6458

Exploitation requires the target system to be actively using the streaming AES-256-GCM API (aes_256_gcm_update) with empty Associated Additional Data (AAD) - this is a specific application-level API usage pattern, not a default or universally present condition. The CVSS 4.0 vector specifies AV:A (adjacent network access required - not internet-facing exploitation) and PR:L (low privileges required, ruling out fully unauthenticated remote attack). The attacker must additionally be able to intercept or modify ciphertext between streaming calls or in the output buffer. Non-streaming AES-256-GCM invocations and any call that provides non-empty AAD are not affected by this defect. The limiting factors for defenders are: (1) only callers explicitly using the streaming API with empty AAD are vulnerable, (2) adjacent-only access vector restricts the attacker population to local-segment or co-hosted scenarios, and (3) low privilege requirement means fully anonymous exploitation is not possible.

The CVSS 4.0 score of 5.1 (Medium) is consistent with the actual threat model: adjacent network vector (AV:A) and low privileges required (PR:L) substantially limit the exploitable population. The integrity impact is low for both the vulnerable system (VI:L) and subsequent systems (SI:L), with no confidentiality or availability impact - the attacker cannot read protected data, only silently corrupt it in a specific scenario. There is no CISA KEV listing, no POC code identified, and no EPSS data was provided, all suggesting no observed active exploitation. However, the severity of the cryptographic failure is higher than the numeric score implies for high-assurance environments: hardware RoT firmware is a trust anchor, and a silent integrity bypass - even a narrow one - in the authenticated encryption layer could undermine boot verification or secure communication guarantees for dependent components. Real-world priority is low for most environments given the niche deployment footprint and specific triggering conditions, but silicon vendors and operators running Caliptra at affected versions in security-critical contexts should treat this as a high-priority fix regardless of CVSS score.

An attacker with adjacent network presence and low-privileged access to a system using Caliptra's streaming AES-256-GCM with empty AAD intercepts the ciphertext produced during the first aes_256_gcm_update call and modifies it in transit or in storage. Because the GHASH accumulator was not checkpointed after that call, the final authentication tag does not incorporate the first block's ciphertext, and the modification passes tag verification silently. No public proof-of-concept code has been identified at time of analysis, so exploitation currently requires understanding of the Caliptra firmware internals and the specific API triggering condition.