30 matches found
CVE-2026-127916
The MCUboot bootloader contains a vulnerability in bootutil_img_hash() where the image hash calculation spans a memory range that is not bounded against the flash slot. This occurs because the function sums ih_hdr_size, ih_img_size, and ih_protect_tlv_size from the image header without overflow c...
CVE-2026-127915
The MCUboot bootloader contains an out-of-bounds read vulnerability in the bootutil_tlv_iter_next() function within boot/bootutil/src/tlv.c. The iterator fails to validate that the header and payload of each TLV entry stay within the declared tlv_end boundary, potentially allowing it to read up t...
CVE-2026-16664
The MCUboot bootloader's Zephyr port contains an out-of-bounds read (CWE-192) in the bs_upload() handler within boot/boot_serial/src/boot_serial.c. The vulnerability occurs because the host-supplied img_num from an MCUmgr image-upload request is processed without a range check before being used t...
CVE-2026-16659
The MCUboot bootloader contains a pre-authentication NULL pointer dereference within the bs_upload() handler in boot/boot_serial/src/boot_serial.c. The vulnerability occurs because the fap pointer is initialized to NULL and only assigned via flash_area_open(). Specific validation failures (malfor...
CVE-2026-16671
The MCUboot bootloader contains an out-of-bounds stack write in the split_image_check() function located in boot/bootutil/src/loader.c. The vulnerability occurs because a fixed 32-byte buffer (loader_hash) is used to store image hashes, but the bootutil_img_validate() routine copies IMAGE_HASH_SI...
CVE-2026-16662
The MCUboot bootloader contains a vulnerability in boot_save_boot_status() where an uninitialised stack buffer (image_hash) can leak up to 63 bytes of bootloader memory into the measured-boot attestation record. This occurs because the TLV handler fails to zero-initialize the buffer and reads a s...
CVE-2026-128091
The MCUboot bootloader contains a vulnerability when built with the TinyCrypt crypto backend (MCUBOOT_USE_TINYCRYPT). The function bootutil_aes_ctr_drop() in boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h was an empty stub, failing to clear the AES-128 key schedule from memory. This ca...
CVE-2026-127928
The MCUboot bootloader contains a vulnerability where plaintext per-image AES keys remain in dead stack memory after handling encrypted images during serial-recovery . Specifically, the functions decrypt_image_inplace() and boot_image_validate_encrypted() in boot_serial_encryption.c fail to clear...
zephyr_cve-2021-3625
CVE-2021-3625 This repository contains a few example exploits for CVE-2021-3625. All Zephyr-based usb devices up to and including version 2.5.0 suffer from a buffer overflow allowing readout of up to 65kB. Depending on the actual device this may result of leakage of sensitive data like encryption...
CVE-2026-14296
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
CVE-2026-14296 nRF54H20: MCUBoot can be tricked to executing unauthenticated code
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
CVE-2026-14296 nRF54H20: MCUBoot can be tricked to executing unauthenticated code
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
EUVD-2026-72297
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
CVE-2026-14296
CVE-2026-14296 affects MCUBoot in its bare (upstream) configuration on the nRF54H20 SoC. When using the Direct XIP update strategy, the main application image can start other cores (e.g., the radio core) by providing an address from an unauthenticated slot, because MCUboot may select different sl...
PT-2026-86649
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
CVE-2026-14296: Improper Verification of Cryptographic Signature
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
CVE-2025-53022: Stack-based Buffer Overflow
TrustedFirmware-M aka Trusted Firmware for M profile Arm CPUs before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade FWU module does not validate the length field of the Type-Length-Value TLV structure for dependen...
CVE-2025-53022
TrustedFirmware-M aka Trusted Firmware for M profile Arm CPUs before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade FWU module does not validate the length field of the Type-Length-Value TLV structure for dependen...
CVE-2024-32883
MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV tag-length-value structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part...
