BI.ZONE
News
Microchip SAMA5D4 vulnerability allows secure boot bypass

Microchip SAMA5D4 vulnerability allows secure boot bypass

BI.ZONE Embedded Systems Security Assessment (ESSA) team discovered a high‑severity vulnerability in Microchip microcontrollers

October 14, 2026

We detected CVE‑2026‑18349, a SAMA5D4 microprocessor vulnerability with a CVSS 4.0 score of 7.3. SAMA5D4 is found in devices with video and graphics capabilities, including medical monitors, media terminals, access control systems, smart home devices, industrial equipment, and popular POS terminal models. Microchip products are used by more than 100,000 companies worldwide.

Exploitation of the vulnerability enables adversaries to bypass the secure boot mechanism, extract firmware encryption keys, and gain access to executable code and other user data stored on the device. We reported the vulnerability to the vendor in accordance with our responsible disclosure procedure.

Microcontroller and secure boot vulnerabilities are particularly dangerous because they undermine the foundation of trust for the entire system. Bypassing secure boot allows attackers to tamper with the device’s software before the operating system and its native controls are initialized. As part of our research, we implemented such an attack against Microchip’s popular microcontroller family. This case once again demonstrates the importance of assessing hardware and boot security for embedded devices, in addition to application software.

Yury Kupashev

Product Owner, BI.ZONE ESSA

Microchip Technology is one of the world’s leading developers and manufacturers of semiconductors and electronic components for the industrial, automotive, and telecommunications markets. Microchip makes product security a top priority. Microchip is aware of this issue and has addressed it with mitigation via the following notification on July 6, 2026 SAMA5D4 Fault Injection Vulnerability | Microchip Technology.

BI.ZONE Embedded Systems Security Assessment is a research laboratory with unique expertise in practical cybersecurity. Its experts specialize in comprehensive security assessments of embedded systems and their components.