CVE-2026-127915
Received Received - Intake

Buffer Overflow in MCUboot Bootloader

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Zephyr Project

Description
The MCUboot TLV iterator bootutil_tlv_iter_next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard (it->tlv_off < it->tlv_end) and advances by sizeof(struct image_tlv) + tlv.it_len using the attacker-controlled it_len field, without validating that the entry's header or payload stays within it->tlv_end. As a result the 4-byte header read can extend up to 3 bytes past the declared TLV area, and the returned (off, len) can describe a payload that runs past it. The path is pre-authentication: TLVs are parsed during bootutil_img_validate() before the signature is verified, and a crafted image can be presented through DFU / serial-recovery / OTA. However the impact is contained by surrounding guards: bootutil_img_validate() first rejects a TLV area larger than bootutil_max_image_size(), the default LOAD_IMAGE_DATA sink is flash_area_read() which bounds-checks against the flash partition and fails an out-of-partition read, and every payload consumer (EXPECTED_HASH_TLV, EXPECTED_KEY_TLV, EXPECTED_SIG_TLV, IMAGE_TLV_SEC_CNT) clamps len against a fixed buffer before copying. The residual effect in a default flash build is therefore an out-of-region read confined to the attacker's own slot partition whose result is never observable, yielding at worst a clean validation failure rather than memory corruption or information disclosure. A genuine (though still bounded) out-of-bounds read remains under the non-default MCUBOOT_RAM_LOAD configuration, where LOAD_IMAGE_DATA is an unchecked memcpy. The fix is to validate each entry's header and payload against it->tlv_end inside the iterator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127915
EUVD
EUVD-2026-124791

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mcu-tools mcuboot From 0.9.0 (inc) to 2.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-127915 is a vulnerability in MCUboot's TLV iterator function bootutil_tlv_iter_next(). It allows an attacker to craft a malicious firmware image with an oversized it_len value, causing the iterator to read beyond the intended TLV section boundary. This results in out-of-bounds flash reads of up to 65535 bytes, potentially exposing sensitive cryptographic data like hashes or signatures.

Detection Guidance

Detecting this vulnerability requires analyzing MCUboot firmware images or bootloader binaries for the presence of the TLV iterator flaw. Check if your MCUboot version is between 0.9.0 and 2.5.0. Inspect the bootutil_tlv_iter_next() function in tlv.c for missing bounds checks on it_len. Use static analysis tools like GCC's -fsanitize=address or custom scripts to verify TLV header and payload boundaries during image parsing.

For embedded systems, monitor boot logs for out-of-bounds read errors during firmware validation. If using MCUBOOT_RAM_LOAD, test with crafted images containing oversized it_len values to observe memcpy behavior. Compare binary hashes against known-good versions if available.

Impact Analysis

The impact depends on the MCUboot configuration. In default flash builds, the effect is limited to a clean validation failure without memory corruption or information disclosure. In non-default RAM_LOAD configurations, it could allow a genuine out-of-bounds read, though still bounded. The worst-case scenario is exposure of cryptographic data if combined with other vulnerabilities.

Compliance Impact

This vulnerability primarily causes out-of-bounds flash reads in MCUboot, which could expose sensitive cryptographic data like hashes or signatures. While it does not directly lead to data exfiltration in default configurations, it may enable signature verification bypass under specific conditions. For compliance standards like GDPR or HIPAA, which require protection of sensitive data, this could pose risks if cryptographic material is exposed or if firmware integrity is compromised, potentially violating data protection requirements.

Mitigation Strategies

Upgrade MCUboot to version 2.5.0 or later which includes the bounds-checking fix in bootutil_tlv_iter_next(). If upgrading is not immediately possible, apply the patch from commit 90f4e7c3ebe4cf9a5eb7d981220388ffdefd6d19 manually to tlv.c. Disable MCUBOOT_RAM_LOAD configuration if enabled, as it increases risk of out-of-bounds memory access.

Restrict physical access to devices to prevent malicious firmware injection via DFU/serial-recovery/OTA. Validate all firmware images using trusted tools before deployment. Monitor security advisories from MCUboot maintainers for additional mitigations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127915. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...