CVE-2026-127915

The MCUboot bootloader contains an out-of-bounds read vulnerability in the bootutil_tlv_iter_next() function within boot/bootutil/src/tlv.c. The iterator fails to validate that the header and payload of each TLV entry stay within the declared tlv_end boundary, potentially allowing it to read up t...