mcu-tools MCUboot up to 2.4.x Split-Image Feature loader.c split_image_check out_hash buffer overflow

Summaryinfo

A vulnerability, which was classified as problematic, has been found in mcu-tools MCUboot up to 2.4.x. Affected by this issue is the function split_image_check of the file boot/bootutil/src/loader.c of the component Split-Image Feature. This manipulation of the argument out_hash causes buffer overflow. This vulnerability is handled as CVE-2026-16671. It is possible to launch the attack on the local host. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in mcu-tools MCUboot up to 2.4.x. Affected by this vulnerability is the function split_image_check of the file boot/bootutil/src/loader.c of the component Split-Image Feature. The manipulation of the argument out_hash with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. As an impact it is known to affect availability. The summary by CVE is:

split_image_check() in boot/bootutil/src/loader.c declares a fixed uint8_t loader_hash[32] buffer and passes it as the out_hash out-parameter to bootutil_img_validate(). That routine copies IMAGE_HASH_SIZE bytes into out_hash (memcpy(out_hash, hash, IMAGE_HASH_SIZE) in boot/bootutil/src/image_validate.c), where IMAGE_HASH_SIZE is a compile-time constant of 64 for MCUBOOT_SHA512 or 48 for MCUBOOT_SIGN_EC384/SHA-384 (boot/bootutil/include/bootutil/crypto/sha.h). The buffer tracks SHA-256 (32 bytes) while the copy length tracks the configured algorithm, so the write overruns the buffer by 16 or 32 bytes. The overflow is only present in a non-default configuration: the legacy Mynewt split-image feature must be compiled (split_go()/split_image_check(), i.e. neither MCUBOOT_DIRECT_XIP nor MCUBOOT_RAM_LOAD), the digest must be larger than 32 bytes (MCUBOOT_SHA512 or MCUBOOT_SIGN_EC384), and MCUBOOT_SIGN_PURE must be off. split_go() is a public API with no caller inside MCUboot; it is invoked from a Mynewt application. In the default SHA-256 build there is no overflow. The over-written bytes are the one-way digest of the loader image and the overflow length is fixed at build time, so the contents are not meaningfully attacker-controlled and the size is not attacker-chosen. The realistic impact is bounded, uncontrolled corruption of the bootloader's stack on the split-boot path, manifesting as instability or failed boot in the affected configuration rather than reliable code execution. The fix is to size loader_hash to IMAGE_HASH_SIZE and pass IMAGE_HASH_SIZE as the matching seed length.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-16671 since 07/22/2026. The exploitation appears to be easy. Attacking locally is a requirement. The exploitation needs additional levels of successful authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.5.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• mcu-tools

Name

• MCUboot

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4

Website

• Product: https://github.com/mcu-tools/mcuboot/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion