MCUboot Serial Recovery Encryption Flaw in Zephyr

CVE-2026-127928

What is CVE-2026-127928?

A vulnerability exists in MCUboot's encrypted-image support where sensitive data, including AES keys, may remain in memory after function executions. The functions decrypt_image_inplace() and boot_image_validate_encrypted() do not clear sensitive struct data from the stack, potentially allowing attackers to recover plaintext encryption keys. This flaw occurs during the upload of encrypted firmware images and the querying of image states, weakening the overall confidentiality of the encryption keys within the bootloader. Although the device's private decryption key remains secure, the leakage of the image's AES content key poses serious risks. To exploit this vulnerability, attackers would require access to the device's RAM, such as through a debug port.

References