CVE-2026-16662

The MCUboot bootloader contains a vulnerability in boot_save_boot_status() where an uninitialised stack buffer (image_hash) can leak up to 63 bytes of bootloader memory into the measured-boot attestation record. This occurs because the TLV handler fails to zero-initialize the buffer and reads a s...