{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-18349",
        "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
        "state": "PUBLISHED",
        "assignerShortName": "Microchip",
        "dateReserved": "2026-07-30T05:06:19.951Z",
        "datePublished": "2026-08-24T16:07:45.500Z",
        "dateUpdated": "2026-10-27T16:40:02.564Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
                "shortName": "Microchip",
                "dateUpdated": "2026-10-27T16:40:02.564Z"
            },
            "title": "SAMA5D44 Fault Injection Vulnerability",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-1247",
                            "description": "CWE-1247 Improper protection against voltage and clock glitches",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-624",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-624 Hardware Fault Injection"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "Microchip",
                    "product": "SAMA5D4",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0"
                        }
                    ],
                    "defaultStatus": "affected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.\n\nThis issue affects SAMA5D4.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.<p>This issue affects SAMA5D4.</p>"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/sama5d44-fault-injection-vulnerability"
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV4_0": {
                        "attackVector": "PHYSICAL",
                        "attackComplexity": "HIGH",
                        "attackRequirements": "NONE",
                        "privilegesRequired": "NONE",
                        "userInteraction": "NONE",
                        "vulnConfidentialityImpact": "HIGH",
                        "subConfidentialityImpact": "HIGH",
                        "vulnIntegrityImpact": "HIGH",
                        "subIntegrityImpact": "HIGH",
                        "vulnAvailabilityImpact": "HIGH",
                        "subAvailabilityImpact": "HIGH",
                        "exploitMaturity": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "valueDensity": "NOT_DEFINED",
                        "vulnerabilityResponseEffort": "NOT_DEFINED",
                        "providerUrgency": "NOT_DEFINED",
                        "version": "4.0",
                        "baseSeverity": "HIGH",
                        "baseScore": 7.3,
                        "vectorString": "CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
                    }
                }
            ],
            "configurations": [
                {
                    "lang": "en",
                    "value": "Access to the VCC_CORE pin.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "Access to the VCC_CORE pin."
                        }
                    ]
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "value": "Because this attack requires direct physical access to the device’s core power supply, the most effective protection is to prevent such access. Customers deploying the SAMA5D4 in security-sensitive applications should review the physical-security assumptions of their deployment and consider measures that make the core supply rail physically inaccessible.  This includes avoiding exposed test points or headers on that rail and employing mechanical protections such as potting, conformal coating, shielding, or tamper-resistant enclosures to prevent attachment of fault-injection equipment.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "Because this attack requires direct physical access to the device’s core power supply, the most effective protection is to prevent such access. Customers deploying the SAMA5D4 in security-sensitive applications should review the physical-security assumptions of their deployment and consider measures that make the core supply rail physically inaccessible.&nbsp; This includes avoiding exposed test points or headers on that rail and employing mechanical protections such as potting, conformal coating, shielding, or tamper-resistant enclosures to prevent attachment of fault-injection equipment."
                        }
                    ]
                }
            ],
            "timeline": [
                {
                    "time": "2026-07-06T07:00:00.000Z",
                    "lang": "en",
                    "value": "Reported"
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Vladimir Kononovich",
                    "type": "finder"
                }
            ],
            "source": {
                "advisory": "PSIRT-151",
                "discovery": "UNKNOWN"
            },
            "x_generator": {
                "engine": "Vulnogram 1.0.4"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-08-24T20:17:41.440102Z",
                                "id": "CVE-2026-18349",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-08-24T20:18:42.750Z"
                }
            }
        ]
    }
}