CVE-2026-16664 | mcu-tools mcuboot up to 2.0.0 Serial-Recovery Upload boot_serial.c bs_upload img_num integer coercion

November 13, 2026 Yanac

A vulnerability marked as problematic has been reported in mcu-tools mcuboot up to 2.0.0. This affects the function bs_upload of the file boot/boot_serial/src/boot_serial.c of the component Serial-Recovery Upload Handler. Performing a manipulation of the argument img_num results in integer coercion error.

This vulnerability is reported as CVE-2026-16664. The attack requires a local approach. No exploit exists.

To fix this issue, it is recommended to deploy a patch.VulDB Recent EntriesRead More