CVE-2026-11835: Core ROM 2.1.0 through 2.1.1

Affected technology

Core ROM · 2.1.0 through 2.1.1
Caliptra

Component: UpdateResetFlow::run()

Attack conditions (Source advisory, CVSS 4.0): Local · High privileges required · No user interaction required

What an attacker can do

A compromised local attacker can silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Source advisory’s CVSS 4.0 assessment (base score 5.7/10) rates confidentiality impact as low; integrity impact as high; availability impact as none.