Skip to content
OpenAdvisories

Vendor

Caliptra

5 known vulnerabilities.

Products

Core Runtime Firmware 3 Core ROM 2 Core Firmware 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.6
    CVE-2026-11835

    Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)

    Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that…

    Caliptra Core ROM
  • Medium 6.8
    CVE-2026-7328

    Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service

    Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AX…

    Caliptra Core Runtime Firmware
  • Medium 5.1
    CVE-2026-6458

    AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty

    Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the first updat…

    Caliptra Core Runtime Firmware