Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2026-7328

Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Caliptra

Description

Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific. This issue affects Core Runtime Firmware: 2.1.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Caliptra Core Runtime Firmware

Default version status: unaffected

  • 2.1.0affected
  • 2.1.1unaffected

References