{"id":"CVE-2026-128091","kind":"vulnerability","aliases":["CVE-2026-128091"],"related":[],"title":"MCUboot: TinyCrypt build leaves image encryption key in RAM after boot","description":"When MCUboot is built with the TinyCrypt crypto backend (MCUBOOT_USE_TINYCRYPT), bootutil_aes_ctr_drop() in boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h was an empty stub. The AES-CTR context for this backend is the fully expanded AES-128 key schedule (struct tc_aes_key_sched_struct). Generic code relies on this hook to release and clear key state, so with TinyCrypt nothing was cleared. The mbedTLS and PSA backends do free or destroy their key state here.\n\nAs a result, boot_state_clear(), which boot_go() calls before handing off to the application, left the image's AES content-encryption key schedule in the static boot_data state. This is the case after an encrypted upgrade in single-image builds, where boot_enc_zeroize() is not called. boot_decrypt_key() likewise left the ECIES-derived key-encryption key schedule on the stack. The affected build uses MCUBOOT_ENC_IMAGES with TinyCrypt, which is the default ECDSA and Ed25519 backend in the Zephyr port.\n\nThe first AES-128 round key equals the cipher key, so anyone who can read the leftover bootloader RAM after boot can recover the image content key and decrypt that encrypted image. That includes a physical attacker with debug or RAM access, or code later running on the device. This weakens image-encryption key confidentiality (and so the confidentiality of the encrypted image's plaintext). The device's long-term private decryption key is not exposed, and image authenticity is not affected. The fix wipes the context with bootutil_wipe_memory().","summary":"When MCUboot is built with the TinyCrypt crypto backend, its AES context cleanup function is an empty stub, so key material stays in bootloader RAM after boot. An attacker who can read that RAM can recover the image content key and decrypt an encrypted firmware image.","severity":"low","cvss":2.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","mcuboot","runtime","tinycrypt","zephyr"],"not_affected_if":["mbedtls-backend","no-image-encryption","psa-backend"],"how_to_check":"- Check whether the build defines `MCUBOOT_USE_TINYCRYPT` and `MCUBOOT_ENC_IMAGES`\n- Check whether the MCUboot version in use is older than the fixed version (unknown from sources)","fix":null,"status":"open","published_at":"2026-11-13T02:18:56+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","triaged_at":"2026-11-13T02:43:10+00:00","updated_at":"2026-11-13T02:43:10+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T02:43:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"MCUboot: TinyCrypt build leaves image encryption key in RAM after boot","impact":"low","summary":"When MCUboot is built with the TinyCrypt crypto backend, its AES context cleanup function is an empty stub, so key material stays in bootloader RAM after boot. An attacker who can read that RAM can recover the image content key and decrypt an encrypted firmware image.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mcuboot","zephyr","embedded","tinycrypt"],"confidence":0.7,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Image encryption key readable from leftover bootloader RAM, enabling decryption","analyst_note":"Find the fixed MCUboot version and the Patch and vendor advisory links (github.com) to confirm the fix and affected version ranges.","how_to_check":"- Check whether the build defines `MCUBOOT_USE_TINYCRYPT` and `MCUBOOT_ENC_IMAGES`\n- Check whether the MCUboot version in use is older than the fixed version (unknown from sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["mbedtls-backend","psa-backend","no-image-encryption"],"who_is_affected":"Only devices that run MCUboot built with the TinyCrypt backend and image encryption (MCUBOOT_ENC_IMAGES), which is the default ECDSA and Ed25519 backend in the Zephyr port. The sources say the issue needs physical RAM or debug access, or code already running on the device, to read the leftover key. Builds using the mbedTLS or PSA backends, or without encrypted images, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000827,"input_tokens":5063,"output_tokens":642,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-128':104C,237C '-128091':14A,17A '-2026':13A,16A 'access':275C 'ae':33B,82C,93C,103C,109C,164C,236C 'aes-ctr':92C 'affect':214C,317C 'anyon':245C 'applic':159C 'attack':51B,270C 'authent':314C 'backend':31B,77C,98C,135C,229C 'boot':11A,49B,147C,151C,173C,190C,196C,254C 'boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h':86C 'bootload':46B,251C 'bootutil':81C,324C 'build':3A,188C,215C 'built':26B,72C 'call':153C,195C 'case':179C 'cipher':242C 'cleanup':35B 'clear':122C,130C,149C 'code':114C,277C 'confidenti':289C,293C 'content':61B,166C,259C 'content-encrypt':165C 'context':34B,95C,322C 'crypto':30B,76C 'ctr':83C,94C 'cve':12A,15A 'data':174C 'debug':272C 'decrypt':64B,197C,262C,307C 'default':225C 'deriv':204C 'destroy':139C 'devic':282C,301C 'drop':84C 'ecdsa':226C 'eci':203C 'ecies-deriv':202C 'ed25519':228C 'embed':18B 'empti':39B,89C 'enc':191C,218C 'encrypt':6A,66B,167C,182C,207C,264C,287C,296C 'equal':240C 'expand':102C 'expos':311C 'firmwar':67B 'first':235C 'fix':319C 'free':137C 'fulli':101C 'function':36B 'generic':113C 'go':152C 'hand':155C 'hook':118C 'imag':5A,60B,68B,162C,187C,219C,258C,265C,286C,297C,313C 'image-encrypt':285C 'includ':267C 'key':7A,42B,62B,105C,110C,123C,141C,168C,198C,206C,208C,239C,243C,260C,288C,308C 'key-encrypt':205C 'later':278C 'leav':4A 'left':160C,200C 'leftov':250C 'likewis':199C 'long':304C 'long-term':303C 'materi':43B 'mbedtl':132C 'mcuboot':1A,19B,24B,70C,78C,217C 'memori':326C 'noth':128C 'physic':269C 'plaintext':299C 'port':233C 'privat':306C 'psa':134C 'ram':9A,47B,56B,252C,274C 'read':54B,248C 'recov':58B,256C 'releas':120C 'reli':115C 'result':146C 'round':238C 'run':279C 'runtim':20B 'sched':111C 'schedul':106C,169C,209C 'singl':186C 'single-imag':185C 'stack':212C 'state':124C,142C,148C,175C 'static':172C 'stay':44B 'struct':107C,112C 'stub':40B,90C 'tc':108C 'term':305C 'tinycrypt':2A,21B,29B,75C,80C,127C,221C 'upgrad':183C 'use':79C,216C 'weaken':284C 'wipe':320C,325C 'zephyr':22B,232C 'zeroiz':192C","nicknames":[],"mitigations":[],"who_affected":"Only devices that run MCUboot built with the TinyCrypt backend and image encryption (MCUBOOT_ENC_IMAGES), which is the default ECDSA and Ed25519 backend in the Zephyr port. The sources say the issue needs physical RAM or debug access, or code already running on the device, to read the leftover key. Builds using the mbedTLS or PSA backends, or without encrypted images, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","low","mcuboot","runtime","tinycrypt","zephyr"],"campaign_type":null,"search_a":"'-128091':14A,17A '-2026':13A,16A 'boot':11A 'build':3A 'cve':12A,15A 'encrypt':6A 'imag':5A 'key':7A 'leav':4A 'mcuboot':1A 'ram':9A 'tinycrypt':2A","search_b":"'ae':33B 'attack':51B 'backend':31B 'boot':49B 'bootload':46B 'built':26B 'cleanup':35B 'content':61B 'context':34B 'crypto':30B 'decrypt':64B 'embed':18B 'empti':39B 'encrypt':66B 'firmwar':67B 'function':36B 'imag':60B,68B 'key':42B,62B 'materi':43B 'mcuboot':19B,24B 'ram':47B,56B 'read':54B 'recov':58B 'runtim':20B 'stay':44B 'stub':40B 'tinycrypt':21B,29B 'zephyr':22B","search_c":"'-128':104C,237C 'access':275C 'ae':82C,93C,103C,109C,164C,236C 'aes-ctr':92C 'affect':214C,317C 'anyon':245C 'applic':159C 'attack':270C 'authent':314C 'backend':77C,98C,135C,229C 'boot':147C,151C,173C,190C,196C,254C 'boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h':86C 'bootload':251C 'bootutil':81C,324C 'build':188C,215C 'built':72C 'call':153C,195C 'case':179C 'cipher':242C 'clear':122C,130C,149C 'code':114C,277C 'confidenti':289C,293C 'content':166C,259C 'content-encrypt':165C 'context':95C,322C 'crypto':76C 'ctr':83C,94C 'data':174C 'debug':272C 'decrypt':197C,262C,307C 'default':225C 'deriv':204C 'destroy':139C 'devic':282C,301C 'drop':84C 'ecdsa':226C 'eci':203C 'ecies-deriv':202C 'ed25519':228C 'empti':89C 'enc':191C,218C 'encrypt':167C,182C,207C,264C,287C,296C 'equal':240C 'expand':102C 'expos':311C 'first':235C 'fix':319C 'free':137C 'fulli':101C 'generic':113C 'go':152C 'hand':155C 'hook':118C 'imag':162C,187C,219C,258C,265C,286C,297C,313C 'image-encrypt':285C 'includ':267C 'key':105C,110C,123C,141C,168C,198C,206C,208C,239C,243C,260C,288C,308C 'key-encrypt':205C 'later':278C 'left':160C,200C 'leftov':250C 'likewis':199C 'long':304C 'long-term':303C 'mbedtl':132C 'mcuboot':70C,78C,217C 'memori':326C 'noth':128C 'physic':269C 'plaintext':299C 'port':233C 'privat':306C 'psa':134C 'ram':252C,274C 'read':248C 'recov':256C 'releas':120C 'reli':115C 'result':146C 'round':238C 'run':279C 'sched':111C 'schedul':106C,169C,209C 'singl':186C 'single-imag':185C 'stack':212C 'state':124C,142C,148C,175C 'static':172C 'struct':107C,112C 'stub':90C 'tc':108C 'term':305C 'tinycrypt':75C,80C,127C,221C 'upgrad':183C 'use':79C,216C 'weaken':284C 'wipe':320C,325C 'zephyr':232C 'zeroiz':192C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T22:07:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128091","severity":null,"published_at":"2026-11-13T02:18:56+00:00","modified_at":"2026-11-13T02:18:56+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","fetched_at":"2026-11-13T02:41:36+00:00","note":null}],"documents":[{"id":141883,"url":"https://github.com/mcu-tools/mcuboot/commit/d204aaa3ab40c0b37a52d3b4c433b437f9ad8374","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":141884,"url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-wx3x-935q-6rcf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-12T22:07:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}