CVE-2026-11835

Caliptra Core ROM (2.1.0–2.1.1) contains a TOCTOU vulnerability in UpdateResetFlow::run() that, with missing input validation, lets a compromised MCU firmware with AXI manager access inject an unvalidated AXI staging address. This bypasses secure boot by not validating against SS_EXTERNAL_STAGING...