PSIRT-151: SAMA5D44 Fault Injection Vulnerability

Date of Disclosure: 07/06/2026

Affected Product:  SAMA5D4

• Vulnerability Type: CWE-1247: Improper Protection Against Voltage and Clock Glitches
• CVE Identifier: CVE-2026-18349
• CVSS Score: 7.3
• Vulnerability Description:
  • By injecting voltage glitches on the VCC_CORE output pin, it is possible to circumvent protections in place in software during the boot process

Exploitation of the vulnerability could allow an attacker to gain full access to execute external code.

Because this attack requires direct physical access to the device’s core power supply, the most effective protection is to prevent such access. Customers deploying the SAMA5D4 in security-sensitive applications should review the physical-security assumptions of their deployment and consider measures that make the core supply rail physically inaccessible.  This includes avoiding exposed test points or headers on that rail and employing mechanical protections such as potting, conformal coating, shielding or tamper-resistant enclosures to prevent attachment of fault-injection equipment.

Reported by Vladimir Kononovich