PatchTheCVECVE-2026-11835: Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (
CVE-2026-11835 is a medium-severity flaw (CVSS 5.7) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-11835?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-11835 being exploited?
CVE-2026-11835 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-11835 affect?
CVE-2026-11835 affects affected software. Severity is medium (CVSS 5.7). Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI s
How urgent is CVE-2026-11835?
Priority 21/100. No elevated risk signals yet.