CVE-2026-7328

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7328", "assignerOrgId": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "state": "PUBLISHED", "assignerShortName": "Caliptra", "dateReserved": "2026-04-28T16:55:51.837Z", "datePublished": "2026-07-22T16:17:27.615Z", "dateUpdated": "2026-07-22T18:49:41.784Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "shortName": "Caliptra", "dateUpdated": "2026-07-22T16:17:27.615Z"}, "title": "Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service", "datePublic": "2026-07-22T19:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "Caliptra", "product": "Core Runtime Firmware", "collectionURL": "https://github.com/chipsalliance/caliptra-sw", "packageName": "Core Runtime Firmware", "modules": ["INVOKE_DPE_MLDSA87", "CM_AES_GCM_DECRYPT_DMA", "EXTERNAL_MAILBOX_CMD"], "versions": [{"status": "affected", "version": "2.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific.\n\nThis issue affects Core Runtime Firmware: 2.1.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific.<p>This issue affects Core Runtime Firmware: 2.1.0.</p>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-c5v4-q445-wv84"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:N"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T18:49:34.151610Z", "id": "CVE-2026-7328", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T18:49:41.784Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7328", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:49:34.151610Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T18:49:38.735Z"}}], "cna": {"tags": ["x_open-source"], "title": "Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Caliptra", "modules": ["INVOKE_DPE_MLDSA87", "CM_AES_GCM_DECRYPT_DMA", "EXTERNAL_MAILBOX_CMD"], "product": "Core Runtime Firmware", "versions": [{"status": "affected", "version": "2.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.1", "versionType": "semver"}], "packageName": "Core Runtime Firmware", "collectionURL": "https://github.com/chipsalliance/caliptra-sw", "defaultStatus": "unaffected"}], "datePublic": "2026-07-22T19:00:00.000Z", "references": [{"url": "https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-c5v4-q445-wv84"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific.\n\nThis issue affects Core Runtime Firmware: 2.1.0.", "supportingMedia": [{"type": "text/html", "value": "Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific.<p>This issue affects Core Runtime Firmware: 2.1.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "shortName": "Caliptra", "dateUpdated": "2026-07-22T16:17:27.615Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7328", "state": "PUBLISHED", "dateUpdated": "2026-07-22T18:49:41.784Z", "dateReserved": "2026-04-28T16:55:51.837Z", "assignerOrgId": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "datePublished": "2026-07-22T16:17:27.615Z", "assignerShortName": "Caliptra"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/chipsalliance/caliptra-sw", "defaultStatus": "unaffected", "modules": ["INVOKE_DPE_MLDSA87", "CM_AES_GCM_DECRYPT_DMA", "EXTERNAL_MAILBOX_CMD"], "packageName": "Core Runtime Firmware", "product": "Core Runtime Firmware", "vendor": "Caliptra", "versions": [{"status": "affected", "version": "2.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.1", "versionType": "semver"}]}], "source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific.\n\nThis issue affects Core Runtime Firmware: 2.1.0."}, {"lang": "es", "value": "Falta de autorizaci\u00f3n en el firmware de tiempo de ejecuci\u00f3n del n\u00facleo de Caliptra (comandos INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD) en modo subsistema permite a un atacante local privilegiado causar una denegaci\u00f3n de servicio a trav\u00e9s de comandos de buz\u00f3n que contienen direcciones AXI no verificadas. El impacto de seguridad m\u00e1s all\u00e1 de la disponibilidad es espec\u00edfico de la integraci\u00f3n.\n\nEste problema afecta al firmware de tiempo de ejecuci\u00f3n del n\u00facleo: 2.1.0."}], "id": "CVE-2026-7328", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7328", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T18:49:34.151610Z", "version": "2.0.3"}}]}, "published": "2026-07-22T17:16:59.557", "references": [{"source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "url": "https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-c5v4-q445-wv84"}], "sourceIdentifier": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.1.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Core Runtime Firmware", "source": "cna", "vendor": "Caliptra"}, "product": "core_runtime_firmware", "vendor": "caliptra"}], "created": "2026-07-23T01:15:02.983642+00:00", "updated": "2026-08-04T15:45:03.820708+00:00", "vendors": ["caliptra", "caliptra$PRODUCT$core_runtime_firmware"]}