Out-of-Bounds Read Vulnerability in MCUboot's Zephyr Serial-Recovery Handler

CVE-2026-16664

What is CVE-2026-16664?

A vulnerability in MCUboot's Zephyr serial-recovery upload handler can lead to out-of-bounds reads by allowing an attacker to manipulate the img_num parameter used in image upload requests. This occurs due to a lack of range checks on the img_num value, which can potentially affect both single and multi-image configurations. If manipulated, the attacker may cause a denial of service by leveraging uncontrolled index values that can read areas outside the intended memory, or even target non-image partitions for unintended operations. A critical fix involves implementing bounds checking on img_num to enhance security and prevent exploitation.

References