CVE-2026-128091 | mcu-tools MCUboot up to 2.4.x TinyCrypt crypto backend aes_ctr_tinycrypt.h bootutil_aes_ctr_drop information disclosure

A vulnerability was found in mcu-tools MCUboot up to 2.4.x and classified as problematic. This issue affects the function bootutil_aes_ctr_drop of the file boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h of the component TinyCrypt crypto backend. Executing a manipulation can lead to information disclosure.

The identification of this vulnerability is CVE-2026-128091. The attack can only be executed locally. There is no exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More