mcu-tools has 8 CVEs on record. Disclosure cadence is accelerating: 8 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 8. The median CVSS is 2.6 (low). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 2.6
- Publish → KEV
- —
- Last 90 days
- 8 prev 0
Worst active — by depth score
CVE-2026-16664Medium· 5.1Unchecked serial-recovery image index causes out-of-bounds slot-table read in MCUboot Zephyr port28CVE-2026-16659Medium· 4.0Pre-authentication NULL pointer dereference in MCUboot serial-recovery image upload (encrypted-image builds)22CVE-2026-16671Low· 2.9Out-of-bounds stack write in MCUboot split-image validation with SHA-384/SHA-512 builds16CVE-2026-127916Low· 2.9MCUboot image hash span is not bounded against the slot, allowing a read past the flash area during image validation16CVE-2026-16662Low· 2.4Uninitialised bootloader stack disclosed into the measured-boot attestation record via a short EXPECTED_HASH TLV in MCUboot13
mcu-tools vulnerabilities
CVEs affecting mcu-tools, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-127928Low· 2.0AES image key left on the stack after serial-recovery encrypted-image handling in MCUboot
In MCUboot's serial-recovery encrypted-image support (boot/boot_serial/src/boot_serial_encryption.c), decrypt_image_inplace() and boot_image_validate_encrypted() each keep a stack-local struct boot_status. boot_enc_load() writes the plai…
CVE-2026-16659Medium· 4.0Pre-authentication NULL pointer dereference in MCUboot serial-recovery image upload (encrypted-image builds)
MCUboot's serial-recovery image-upload handler bs_upload() in boot/boot_serial/src/boot_serial.c declares const struct flash_area *fap = NULL and assigns it only via flash_area_open() part-way through the function. Two early validation f…
CVE-2026-128091Low· 2.0AES key schedule not cleared by the TinyCrypt AES-CTR backend in MCUboot bootutil
When MCUboot is built with the TinyCrypt crypto backend (MCUBOOT_USE_TINYCRYPT), bootutil_aes_ctr_drop() in boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h was an empty stub. The AES-CTR context for this backend is the fully ex…
CVE-2026-16671Low· 2.9Out-of-bounds stack write in MCUboot split-image validation with SHA-384/SHA-512 builds
split_image_check() in boot/bootutil/src/loader.c declares a fixed uint8_t loader_hash[32] buffer and passes it as the out_hash out-parameter to bootutil_img_validate(). That routine copies IMAGE_HASH_SIZE bytes into out_hash (memcpy(out…
CVE-2026-16664Medium· 5.1Unchecked serial-recovery image index causes out-of-bounds slot-table read in MCUboot Zephyr port
MCUboot's Zephyr serial-recovery upload handler bs_upload() in boot/boot_serial/src/boot_serial.c decodes the host-supplied image field of an MCUmgr image-upload request into img_num (a full 32-bit value) and latches it on the off == 0 p…
CVE-2026-16662Low· 2.4Uninitialised bootloader stack disclosed into the measured-boot attestation record via a short EXPECTED_HASH TLV in MCUboot
boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer image_hash[IMAGE_HASH_SIZE] that is never zero-initialised. The TLV handler validates only the upper bound (len > sizeof(i…
CVE-2026-127915Low· 2.0TLV iterator does not bound each entry against the declared TLV area in MCUboot bootutil
The MCUboot TLV iterator bootutil_tlv_iter_next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard (it->tlv_off < it->tlv_end) and advances by sizeof(struct image_tlv) + tlv.it_len using the attacker-controlle…
CVE-2026-127916Low· 2.9MCUboot image hash span is not bounded against the slot, allowing a read past the flash area during image validation
bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash a…