PT-2026-146106

The MCUboot TLV iterator bootutil tlv iter next in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard it-tlv off tlv end and advances by sizeofstruct image tlv + tlv.it len using the attacker-controlled it len field, without validating that the entry's header or payload sta...