Caliptra Core Firmware CVE-2026-6458

Q: What is the CVSS score of CVE-2026-6458?

CVE-2026-6458 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Missing Cryptographic Step (CWE-325)

2026-06-23 Caliptra

Information Disclosure Core Runtime Firmware

5.1

CVSS 4.0 · Vendor: Caliptra

Severity by source

Vendor (Caliptra) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.0 LOW

AV:A and PR:L match vendor assessment; AC:H reflects the specific streaming-API-with-empty-AAD prerequisite; S:C captures downstream integrity impact on systems trusting the RoT.

3.1 AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Caliptra).

CVSS VectorVendor: Caliptra

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 00:26 vuln.today

DescriptionCVE.org

Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the first update call, causing the final tag to exclude the first batch of processed ciphertext. Ciphertext produced by that call may be modified without the tag reflecting the change.

This issue affects Core Runtime Firmware: from 2.0.0 through 2.0.1, 2.1.0.

AnalysisAI

Broken GCM integrity in Caliptra Core Runtime Firmware 2.0.0-2.1.0 allows an adjacent, low-privileged attacker to silently tamper with ciphertext produced by the streaming AES-256-GCM API when called with empty AAD. The root defect - a missing save of the hardware GHASH accumulator state after the first streaming update call - causes the final authentication tag to exclude the first batch of processed ciphertext, nullifying the integrity guarantee of authenticated encryption for that block. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Caliptra is an open-source hardware Root of Trust (RoT) specification developed under CHIPSALLIANCE, targeting datacenter and server-class silicon. The aes_256_gcm_update module within Core Runtime Firmware implements AES-256-GCM, an authenticated encryption with associated data (AEAD) scheme. GCM authentication relies on the GHASH function, which incrementally accumulates partial ciphertext blocks into a running polynomial hash. In the streaming (multi-call) API flow, the GHASH accumulator must be checkpointed after each update call so subsequent calls can continue from the correct state. CWE-325 (Missing Required Cryptographic Step) precisely characterizes the defect: when AAD is empty, the firmware omits the accumulator save after the first update call, meaning the final authentication tag is computed from an accumulator that reflects only ciphertext from the second call onward. Any silicon vendor integrating Caliptra firmware at affected versions inherits this cryptographic integrity gap in their RoT implementation.

RemediationAI

Consult the CHIPSALLIANCE Caliptra security advisory at https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-834g-h5x6-2hqr for the upstream fix; a specific patched release version is not independently confirmed from the available data, so track the caliptra-sw repository for a tagged release addressing this advisory. As a compensating control prior to patching, callers of the streaming AES-256-GCM API should supply non-empty AAD (even a constant sentinel value) to avoid triggering the vulnerable code path - this changes the API contract but eliminates the GHASH state loss condition. Alternatively, restricting usage to non-streaming (single-call) AES-256-GCM invocations avoids the multi-update flow entirely; note this may require application-level refactoring and could impact performance for large payloads. Silicon vendors integrating Caliptra should audit their firmware supply chain to identify which die revisions or product lines incorporate affected Core Runtime Firmware versions and prioritize ROM/firmware updates accordingly.