CVE-2026-18349: Microchip SAMA5D4 Hardware Fault Injection

CVE-2026-18349 Overview

CVE-2026-18349 is a hardware fault injection vulnerability affecting the Microchip SAMA5D4 microprocessor. The device lacks adequate protection against voltage and clock glitches, allowing an attacker with physical access to induce faults that compromise the confidentiality, integrity, and availability of code and data executing on the chip. The weakness is tracked under [CWE-1247: Improper Protection Against Voltage and Clock Glitches]. Because the SAMA5D4 is deployed in embedded systems, industrial controllers, and secure boot chains, successful glitching can undermine cryptographic operations, secure boot enforcement, and stored secrets.

Critical Impact
An attacker with physical access can bypass secure boot, extract cryptographic material, or alter program execution on affected SAMA5D4-based devices through targeted voltage or clock manipulation.

Affected Products

Microchip SAMA5D4 system-on-chip
Embedded devices and industrial products built on the SAMA5D4 platform
Systems relying on SAMA5D4 secure boot or on-chip secret storage

Discovery Timeline

2026-08-24 - CVE-2026-18349 published to the National Vulnerability Database
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-18349

Vulnerability Analysis

The SAMA5D4 does not implement sufficient countermeasures against transient perturbation of its supply voltage or clock signal. Attackers use fault injection to skip instructions, corrupt register values, or bypass conditional checks during sensitive operations. In practice this targets code paths such as signature verification during secure boot, PIN or password comparison routines, and cryptographic primitives that leak key material under faulted execution. The vulnerability is classified as [CWE-1247] and requires physical proximity to the target device.

Root Cause

The root cause is the absence of hardware-level glitch detection and mitigation inside the SAMA5D4. Robust designs incorporate voltage monitors, clock integrity detectors, redundant execution, and tamper response logic. The SAMA5D4 lacks these protections at a strength adequate to resist practical fault injection attacks, so induced glitches propagate directly into logic state and instruction flow.

Attack Vector

Exploitation requires physical access. An attacker attaches probes to the power rails or clock inputs, then uses a glitching platform such as a ChipWhisperer or a custom pulse generator to drop the core voltage or inject a clock anomaly at a precise moment. Repeated attempts, timed against observable side channels, eventually produce a fault that alters execution at a security-critical branch. No network access, credentials, or user interaction are needed.

No public proof-of-concept code is available for this CVE. Refer to the Microchip Security Advisory for SAMA5D4 Fault Injection for vendor guidance.

Detection Methods for CVE-2026-18349

Indicators of Compromise

Physical evidence of tampering on device enclosures, including drilled holes, decapsulated packages, or soldered leads on power and clock pins
Unexpected resets, boot loops, or secure boot failures logged by the device firmware
Anomalous cryptographic outputs or authentication successes without valid credentials in audit logs

Detection Strategies

Enable and monitor secure boot failure counters and firmware integrity events exported by the SAMA5D4 platform
Correlate device telemetry with physical tamper switches, enclosure sensors, or environmental monitoring where available
Review supply chain and field service logs for unauthorized physical access to deployed devices

Monitoring Recommendations

Forward device syslog, secure boot, and tamper events to a centralized logging platform for correlation and long-term retention
Alert on repeated reset patterns or abnormal power-cycle sequences that align with glitching attempts
Track firmware version and boot measurement drift across fleets to identify devices returning altered state

How to Mitigate CVE-2026-18349

Immediate Actions Required

Inventory all products and deployments that incorporate the Microchip SAMA5D4 and identify those exposed to untrusted physical environments
Restrict physical access to affected devices using locked enclosures, tamper-evident seals, and controlled facility access
Contact Microchip and downstream device vendors to obtain the current security advisory and any hardware or firmware remediation guidance

Patch Information

This is a hardware weakness in the SAMA5D4 silicon and cannot be fully resolved through software patches alone. Consult the Microchip Security Advisory for SAMA5D4 Fault Injection for vendor recommendations, including any firmware updates, product notices, or successor devices with improved fault injection resistance.

Workarounds

Add software-level fault injection countermeasures such as double-checking critical branches, redundant cryptographic verification, and constant-time comparisons
Deploy active tamper detection hardware around the SAMA5D4, including voltage and clock supervisors that trigger secure erase on anomalies
Migrate high-assurance workloads to devices with certified fault injection resistance, or offload secret storage to an external secure element
Enforce physical security controls such as sealed enclosures, tamper meshes, and monitored deployment environments

bash

# Configuration example not applicable — this is a hardware vulnerability.
# Refer to the Microchip advisory for device-specific hardening guidance.