CVE-2026-16662

bootsavebootstatus in boot/bootutil/src/bootrecord.c reads the image's EXPECTEDHASHTLV into a stack buffer imagehashIMAGEHASHSIZE that is never zero-initialised. The TLV handler validates only the upper bound len sizeofimagehash and then reads exactly len bytes, so a TLV shorter than IMAGEHASHSIZ...

EUVD-2026-124812

bootsavebootstatus in boot/bootutil/src/bootrecord.c reads the image's EXPECTEDHASHTLV into a stack buffer imagehashIMAGEHASHSIZE that is never zero-initialised. The TLV handler validates only the upper bound len sizeofimagehash and then reads exactly len bytes, so a TLV shorter than IMAGEHASHSIZ...

CVE-2026-16662

The MCUboot bootloader contains a vulnerability in boot_save_boot_status() where an uninitialised stack buffer (image_hash) can leak up to 63 bytes of bootloader memory into the measured-boot attestation record. This occurs because the TLV handler fails to zero-initialize the buffer and reads a s...

CVE-2026-16662 Uninitialised bootloader stack disclosed into the measured-boot attestation record via a short EXPECTED_HASH TLV in MCUboot

bootsavebootstatus in boot/bootutil/src/bootrecord.c reads the image's EXPECTEDHASHTLV into a stack buffer imagehashIMAGEHASHSIZE that is never zero-initialised. The TLV handler validates only the upper bound len sizeofimagehash and then reads exactly len bytes, so a TLV shorter than IMAGEHASHSIZ...