CVE-2026-16664

The MCUboot bootloader's Zephyr port contains an out-of-bounds read (CWE-192) in the bs_upload() handler within boot/boot_serial/src/boot_serial.c. The vulnerability occurs because the host-supplied img_num from an MCUmgr image-upload request is processed without a range check before being used t...

CVE-2026-16659

The MCUboot bootloader contains a pre-authentication NULL pointer dereference within the bs_upload() handler in boot/boot_serial/src/boot_serial.c. The vulnerability occurs because the fap pointer is initialized to NULL and only assigned via flash_area_open(). Specific validation failures (malfor...