mcuboot vulnerabilities and CVEs

Known vulnerabilities affecting mcuboot, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

8 vulnerabilities tracked.

• 5.1 MCUboot's Zephyr serial-recovery upload handler bsupload() in boot/bootserial/src/bootserial.c decodes the host-supplied image field of an… CVE-2026-16664 13 Nov 2026
• 4.0 MCUboot's serial-recovery image-upload handler bsupload() in boot/bootserial/src/bootserial.c declares const struct flasharea fap = NULL… CVE-2026-16659 13 Nov 2026
• 2.9 bootutilimghash() computes the image digest over ihhdrsize + ihimgsize + ihprotecttlvsize bytes, all three taken from the candidate image's… CVE-2026-127916 13 Nov 2026
• 2.9 splitimagecheck() in boot/bootutil/src/loader.c declares a fixed uint8t loaderhash[32] buffer and passes it as the outhash out-parameter to… CVE-2026-16671 13 Nov 2026
• 2.4 bootsavebootstatus() in boot/bootutil/src/bootrecord.c reads the image's EXPECTEDHASHTLV into a stack buffer imagehash[IMAGEHASHSIZE] that… CVE-2026-16662 13 Nov 2026
• 2.0 The MCUboot TLV iterator bootutiltlviternext() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard (it->tlvoff… CVE-2026-127915 13 Nov 2026
• 2.0 When MCUboot is built with the TinyCrypt crypto backend (MCUBOOTUSETINYCRYPT), bootutilaesctrdrop() in… CVE-2026-128091 13 Nov 2026
• 2.0 In MCUboot's serial-recovery encrypted-image support (boot/bootserial/src/bootserialencryption.c), decryptimageinplace() and… CVE-2026-127928 13 Nov 2026