Memory Disclosure Flaw in MCUBoot for Zephyr Systems

CVE-2026-16662

What is CVE-2026-16662?

A vulnerability in the MCUBoot bootloader may allow attackers to exploit uninitialized stack memory within the boot record. Specifically, the function boot_save_boot_status() handles an image's EXPECTED_HASH_TLV without correctly zero-initializing the stack buffer, potentially leaking up to 63 bytes of stale stack content. This incident mainly occurs under configurations where the primary-slot validation is disabled, which allows for the insertion of crafted images and can result in untrusted boot-record measurements. Notably, this issue does not lead to integrity or availability compromises but highlights a critical aspect of bootloader security and the potential risks associated with unverified data being sent to remote verifiers.

References