mcu-tools mcuboot up to 2.4.x Iterator boot/bootutil/src/tlv.c bootutil_tlv_iter_next it_len out-of-bounds

Summaryinfo

A vulnerability classified as critical has been found in mcu-tools mcuboot up to 2.4.x. Affected is the function bootutil_tlv_iter_next of the file boot/bootutil/src/tlv.c of the component Iterator. The manipulation of the argument it_len leads to out-of-bounds. This vulnerability is traded as CVE-2026-127915. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in mcu-tools mcuboot up to 2.4.x. It has been rated as critical. This issue affects the function bootutil_tlv_iter_next of the file boot/bootutil/src/tlv.c of the component Iterator. The manipulation of the argument it_len with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is availability. The summary by CVE is:

The MCUboot TLV iterator bootutil_tlv_iter_next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard (it->tlv_off < it->tlv_end) and advances by sizeof(struct image_tlv) + tlv.it_len using the attacker-controlled it_len field, without validating that the entry's header or payload stays within it->tlv_end. As a result the 4-byte header read can extend up to 3 bytes past the declared TLV area, and the returned (off, len) can describe a payload that runs past it. The path is pre-authentication: TLVs are parsed during bootutil_img_validate() before the signature is verified, and a crafted image can be presented through DFU / serial-recovery / OTA. However the impact is contained by surrounding guards: bootutil_img_validate() first rejects a TLV area larger than bootutil_max_image_size(), the default LOAD_IMAGE_DATA sink is flash_area_read() which bounds-checks against the flash partition and fails an out-of-partition read, and every payload consumer (EXPECTED_HASH_TLV, EXPECTED_KEY_TLV, EXPECTED_SIG_TLV, IMAGE_TLV_SEC_CNT) clamps len against a fixed buffer before copying. The residual effect in a default flash build is therefore an out-of-region read confined to the attacker's own slot partition whose result is never observable, yielding at worst a clean validation failure rather than memory corruption or information disclosure. A genuine (though still bounded) out-of-bounds read remains under the non-default MCUBOOT_RAM_LOAD configuration, where LOAD_IMAGE_DATA is an unchecked memcpy. The fix is to validate each entry's header and payload against it->tlv_end inside the iterator.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-127915 since 11/12/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 2.5.0 eliminates this vulnerability. Applying the patch 90f4e7c3ebe4cf9a5eb7d981220388ffdefd6d19 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• mcu-tools

Name

• mcuboot

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4

Website

• Product: https://github.com/mcu-tools/mcuboot/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion