--- id: "CVE-2026-127916" page: "https://infrastack.ai/live/CVE-2026-127916" kind: "vulnerability" aliases: ["CVE-2026-127916"] title: "MCUboot: unbounded image hash lets a malformed header crash boot" severity: "low" cvss: 2.9 epss: null exploited: false status: "open" category: "infrastructure" products: [] ecosystems: [] tags: ["cypress-psoc6", "embedded", "infrastructure", "mcuboot", "zephyr"] not_affected_if: ["bounds-checked-flash-backend", "default-config"] published_at: "2026-11-13T02:18:55+00:00" first_seen_at: "2026-11-13T02:41:36+00:00" updated_at: "2026-11-13T02:43:09+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127916", "first_seen_at": "2026-11-13T02:41:36+00:00"}] exploit_sources: [] --- # MCUboot: unbounded image hash lets a malformed header crash boot Link for people: https://infrastack.ai/live/CVE-2026-127916 (this .md is for agents) MCUboot computes the firmware image digest over header-supplied sizes without checking they fit in the flash slot. A crafted image placed in a slot can cause an out-of-bounds flash read during validation, which can fault and block booting; nothing is disclosed. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Check the MCUboot version in the build: `mcuboot` 2.2.0 or later includes the header-size check, except the compressed-secondary-slot case noted in the sources. - Check whether `CONFIG_BOOT_IMG_HASH_DIRECTLY_ON_STORAGE` (Zephyr) or `MCUBOOT_HASH_STORAGE_DIRECTLY` is enabled; that setting skips the bounds check. - Check whether the Cypress PSoC6 port (1.6.0 or later) is in use, since its flash_area_read() does not bound reads. ## Fix - MCUboot: the sources describe the fix as bounding the hashed span in bootutil_img_hash() with boot_u32_safe_add() and rejecting images that do not fit; no fixed release version is stated in the sources. ## Timeline - 2026-11-13T02:41:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127916 ## Documents - [advisory] Vendor advisory: github.com https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-c7cx-5pqv-x9m6 - [fix] Patch: github.com https://github.com/mcu-tools/mcuboot/commit/e9abe4f0292f0ed72391e146e098e22547b2d78b ## From the sources bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing earlier on the validation path bounds the whole span either: bootutil_img_validate() compares the image size against bootutil_max_image_size() only after the hash has been computed. The callers bound part of the span, or none of it: On the swap and overwrite upgrade path, boot_validate_slot() first runs the image header check (boot_is_header_valid(), later boot_check_header_valid()). Before MCUboot 2.2.0 that check covered only ih_hdr_size + ih_img_size, so for every image the protected-TLV area (ih_protect_tlv_size, a uint16_t, up to 65535 bytes) was hashed without being bounded. From 2.2.0 the check includes ih_protect_tlv_size, except for a compressed image in the secondary slot when MCUBOOT_DECOMPRESS_IMAGES (CONFIG_BOOT_DECOMPRESSION) is enabled, which leaves the same gap of up to 64 KB. The serial recovery image-list and image-state handlers (bs_list() and bs_set() in boot/boot_serial/src/boot_serial.c) and Zephyr's single-slot and firmware loaders (boot/zephyr/single_loader.c, boot/zephyr/firmware_loader.c) call bootutil_img_validate() with no header check at all, so on those paths ih_img_size is unbounded as well. The image is hashed before its signature is checked, so anyone who can place an image in a slot (an OTA or SMP update delivered through the application, or serial recovery) reaches this read before authentication. Whether a malformed header produces an actual read beyond the area depends on the flash backend: Backends whose flash_area_read() bounds-checks the request (Zephyr, Espressif, NuttX, Mbed) return an error once the chunked read crosses the end of the area. Validation fails and the image is rejected, with no over-read. With MCUBOOT_HASH_STORAGE_DIRECTLY (Zephyr CONFIG_BOOT_IMG_HASH_DIRECTLY_ON_STORAGE, available from 2.2.0, not enabled by default) the span is hashed through a single direct pointer into memory-mapped flash, with no bounds check. The Cypress PSoC6 port's flash_area_read() (boot/cypress/cy_flash_pal/cy_flash_map.c, from 1.6.0) does not bound the read: its assert()s compare against the area's absolute offset rather than its size, and it copies with memcpy(). The bytes read past the area feed only the digest, which is compared internally and never returned, so nothing is disclosed. The realistic effect is a read fault during image validation: up to 64 KB past the slot on the upgrade path, and potentially much further on the paths that skip the header check. Where validation is repeated at every boot (a pending upgrade, or the single-slot loader checking its image), the fault can recur on each reset and keep the device from booting. The fix makes bootutil_img_hash() add the three sizes with boot_u32_safe_add() and reject an image whose span, including the sector offset used in swap-using-offset mode, does not fit in the flash area, before any of it is hashed. Because the bound is applied where the bytes are read, it covers every caller. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_