Memory Handling Flaw in MCUboot Affects Bootloaders from Zephyr and Mynewt

CVE-2026-16659

What is CVE-2026-16659?

A vulnerability exists in MCUboot's serial-recovery image-upload handler due to improper handling of memory. The function, which should operate on a designated flash area, inadvertently attempts to dereference a NULL pointer when a malformed payload is received during the very first serial-recovery upload command. This flaw can lead to transient denial of service of the bootloader during recovery sessions, although it does not facilitate memory corruption or information leaks. The vulnerability affects builds with encrypted images and allows unauthenticated access via serial recovery, presenting a low-value transient crash risk. Specific ports impacted include the Zephyr and Mynewt, while others such as Espressif, NuttX, Cypress, and Mbed remain unaffected.

References