CVE-2026-16659 | mcu-tools MCUboot up to 2.4.x Serial-Recovery Image-Upload boot_serial.c bs_upload null pointer dereference

November 13, 2026 Yanac

A vulnerability labeled as problematic has been found in mcu-tools MCUboot up to 2.4.x. The impacted element is the function bs_upload of the file boot/boot_serial/src/boot_serial.c of the component Serial-Recovery Image-Upload Handler. Such manipulation leads to null pointer dereference.

This vulnerability is documented as CVE-2026-16659. The attack needs to be performed locally. There is not any exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More