{"id":"CVE-2026-11835","summary":"Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)","details":"Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra.\n\nThis issue affects Core ROM: 2.1.0 through 2.1.1.","aliases":["GHSA-49mm-5gq5-v97f"],"modified":"2026-08-07T11:48:51.667703935Z","published":"2026-08-04T00:03:23.278Z","database_specific":{"cwe_ids":["CWE-20","CWE-367"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11835.json","cna_assigner":"Caliptra"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11835.json"},{"type":"ADVISORY","url":"https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-49mm-5gq5-v97f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11835"},{"type":"PACKAGE","url":"https://github.com/chipsalliance/caliptra-sw"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/chipsalliance/caliptra-sw","events":[{"introduced":"a72a76f234d9f7069ddd1e8b8ebef30a9c3fa326"},{"fixed":"510a23adbc911e8e72708799daba964ec045ef25"}],"database_specific":{"extracted_events":[{"introduced":"2.1.0"},{"last_affected":"2.1.1"},{"fixed":"2.1.1"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["release_v20260319_0-2.x","release_v20260317_0-2.x","release_v20260312_0-2.x","release_v20260310_1-2.x","fw-2.1.0","release_v20260310_0-2.x","release_v20260218_0-2.x","release_v20260217_0-2.x","release_v20260214_0-2.x","rom-2.1.0","release_v20260207_1-2.x","release_v20260207_0-2.x"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11835.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"}]}