CVE-2026-11835
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
21/100
Published: 2026-08-04
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
High
UI:
None
S:
X
AT:
Present
VC:
Low
VI:
High
VA:
None
Description
Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra. This issue affects Core ROM: 2.1.0 through 2.1.1.