EUVD-2026-124812

bootsavebootstatus in boot/bootutil/src/bootrecord.c reads the image's EXPECTEDHASHTLV into a stack buffer imagehashIMAGEHASHSIZE that is never zero-initialised. The TLV handler validates only the upper bound len sizeofimagehash and then reads exactly len bytes, so a TLV shorter than IMAGEHASHSIZ...