CVE-2026-127915 | mcu-tools mcuboot up to 2.4.x Iterator boot/bootutil/src/tlv.c bootutil_tlv_iter_next it_len out-of-bounds

November 13, 2026 Yanac

A vulnerability described as critical has been identified in mcu-tools mcuboot up to 2.4.x. This impacts the function bootutil_tlv_iter_next of the file boot/bootutil/src/tlv.c of the component Iterator. Executing a manipulation of the argument it_len can lead to out-of-bounds read.

This vulnerability appears as CVE-2026-127915. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More