CVE-2026-18796: CWE-1342 Information exposure through microarchitectural state after transient execution in Nordic Semiconductor ASA nRF5340

This vulnerability (CVE-2026-18796) concerns information exposure via microarchitectural state after transient execution on the nRF5340 device. Applications using external QSPI flash for encrypted XIP that rely on this encryption for confidentiality or integrity of externally stored code are affected. The root cause is the on-the-fly decryption scheme implemented in the hardware or firmware, not tied to any particular SDK version. The CVSS 4.0 score is 6.8, indicating medium severity, with attack vector being physical (AV:P), high attack complexity, and requiring no privileges or user interaction.

The vulnerability allows potential exposure of sensitive information from the microarchitectural state after transient execution, which could compromise the confidentiality and integrity of code stored externally on QSPI flash when encrypted XIP is used. This could undermine the security guarantees of encrypted execute-in-place on affected devices.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider the risk of information exposure when using encrypted XIP on external QSPI flash with nRF5340 and apply any recommended vendor mitigations once published.