Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-18349

SAMA5D44 Fault Injection Vulnerability

High7.3EPSS 0.18%
Published
Updated
Reserved
Assigned by
Microchip

Description

Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.

Timeline

  1. ID reserved

    By Microchip

  2. · 25 days later

    Published

  3. · 2 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-18349, by who scored it
Scored byCVSSScoreVector
MicrochipCNA (assigner)4.0High7.3CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVDNVD · Deferred4.0High7.3CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.18% · top 92% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Weakness

Affected products

What to do

Solution: Because this attack requires direct physical access to the device’s core power supply, the most effective protection is to prevent such access. Customers deploying the SAMA5D4 in security-sensitive applications should review the physical-security assumptions of their deployment and consider measures that make the core supply rail physically inaccessible.  This includes avoiding exposed test points or headers on that rail and employing mechanical protections such as potting, conformal coating, shielding, or tamper-resistant enclosures to prevent attachment of fault-injection equipment.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-18349 badge
[![CVE-2026-18349](https://trackcve.app/badge/CVE-2026-18349.svg)](https://trackcve.app/cve/CVE-2026-18349)

Record last updated .