CVE-2026-7328

{
  "id": "CVE-2026-7328",
  "sourceIdentifier": "b01ddd03-5ef6-483b-b2c5-acba77f1a554",
  "published": "2026-07-22T17:16:59.557",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific.\n\nThis issue affects Core Runtime Firmware: 2.1.0."
    },
    {
      "lang": "es",
      "value": "Falta de autorización en el firmware de tiempo de ejecución del núcleo de Caliptra (comandos INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD) en modo subsistema permite a un atacante local privilegiado causar una denegación de servicio a través de comandos de buzón que contienen direcciones AXI no verificadas. El impacto de seguridad más allá de la disponibilidad es específico de la integración.\n\nEste problema afecta al firmware de tiempo de ejecución del núcleo: 2.1.0."
    }
  ],
  "affected": [
    {
      "source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554",
      "affectedData": [
        {
          "vendor": "Caliptra",
          "product": "Core Runtime Firmware",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/chipsalliance/caliptra-sw",
          "packageName": "Core Runtime Firmware",
          "modules": [
            "INVOKE_DPE_MLDSA87",
            "CM_AES_GCM_DECRYPT_DMA",
            "EXTERNAL_MAILBOX_CMD"
          ],
          "versions": [
            {
              "version": "2.1.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.1.1",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T18:49:34.151610Z",
          "id": "CVE-2026-7328",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-c5v4-q445-wv84",
      "source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554"
    }
  ]
}