# CVE-2026-7328: Caliptra Core Runtime Firmware missing authorization in mailbox commands

Source: https://junglewise.ai/threats/cve-2026-7328-caliptra-core-runtime-firmware-missing-authorization-in-mailbox  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-7328 · Severity: info · CVSS 6.8 · Published 2026-07-22

Caliptra Core Runtime Firmware is used to provide a secure foundation for hardware systems. A security flaw in how the firmware handles certain commands allows a local user with basic privileges to crash the system or cause it to stop responding. This could lead to a total service outage or require a manual reset of the affected hardware.

Technologies: [CHIPS Alliance Core Runtime Firmware](https://junglewise.ai/threats/technologies/core-runtime-firmware). Vendors: [CHIPS Alliance](https://junglewise.ai/threats/vendors/chips-alliance).

## Quick answers

**Is CVE-2026-7328 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7328 being exploited in the wild.

**How severe is CVE-2026-7328?** Informational severity, with a CVSS score of 6.8, published 22 July 2026.

**Which products and versions are affected?** CHIPS Alliance Core Runtime Firmware 2.1.0.

**Is there a fix for CVE-2026-7328?** A patch was published on 2026-07-22: Fixed in version 2.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7328 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-7328?** Check whether you run CHIPS Alliance Core Runtime Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability exists in Caliptra Core Runtime Firmware version 2.1.0 when operating in subsystem mode. The affected commands—INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD—perform DMA reads or writes using unverified AXI addresses provided within the command. A local attacker with low privileges can exploit this by providing an invalid or unauthorized AXI address, causing the system to attempt an invalid DMA access. This typically results in a system hang (Denial of Service), though further impacts to system integrity may occur depending on the specific hardware integration. The issue is addressed in version 2.1.1.

## Affected products

- Caliptra Core Runtime Firmware 2.1.0

## Timeline

- 2026-07-22: advisory
- 2026-07-22: disclosed
- 2026-07-22: patched: Fixed in version 2.1.1

## References

- [https://github.com/chipsalliance/caliptra-sw](https://github.com/chipsalliance/caliptra-sw)
- [https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-c5v4-q445-wv84](https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-c5v4-q445-wv84)

## Related threats

- [Caliptra Core Runtime Firmware authentication bypass in activate_fw](https://junglewise.ai/threats/cve-2026-5818-caliptra-core-runtime-firmware-authentication-bypass-in-activate)