CVE-2026-7328 — Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service
Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local a…
Published: 2026-07-22 · CVSS: 6.8 · CVSS 4.0
Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific. This issue affects Core Runtime Firmware: 2.1.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7