Improper input validation in Caliptra Core Rom
CVE-2026-11835
Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Affected products
- Caliptra Core Rom — versions 2.1.0, 2.1.2