---
id: "CVE-2026-16659"
page: "https://infrastack.ai/live/CVE-2026-16659"
kind: "vulnerability"
aliases: ["CVE-2026-16659"]
title: "MCUboot: malformed serial-recovery upload crashes bootloader via NULL flash pointer"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "mcuboot", "mynewt", "runtime", "zephyr"]
not_affected_if: ["cypress-port", "default-config", "espressif-port", "mbed-port", "nuttx-port", "serial-recovery-disabled"]
published_at: "2026-11-13T02:18:56+00:00"
first_seen_at: "2026-11-13T02:41:37+00:00"
updated_at: "2026-11-13T02:43:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16659", "first_seen_at": "2026-11-13T02:41:37+00:00"}]
exploit_sources: []
---

# MCUboot: malformed serial-recovery upload crashes bootloader via NULL flash pointer

Link for people: https://infrastack.ai/live/CVE-2026-16659 (this .md is for agents)

MCUboot's serial-recovery upload handler dereferences a NULL flash area pointer when the first upload command has a malformed payload and encrypted-image support is enabled. An unauthenticated attacker on the serial console can trigger a transient bootloader crash, with no code execution or data disclosure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the build defines `MCUBOOT_ENC_IMAGES` (Zephyr `CONFIG_BOOT_ENCRYPT_IMAGE`, Mynewt any `BOOTUTIL_ENCRYPT_` syscfg) together with serial recovery (`MCUBOOT_SERIAL` / `CONFIG_MCUBOOT_SERIAL`).
- Confirm the port is Zephyr or Mynewt; Espressif, NuttX, Cypress and Mbed are not affected.

## Timeline

- 2026-11-13T02:41:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16659

## Documents

- [advisory] Vendor advisory: github.com https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-777r-3chm-p78c
- [fix] Patch: github.com https://github.com/mcu-tools/mcuboot/commit/400f9a7242641655948b08acac19932f56d9881f

## From the sources

MCUboot's serial-recovery image-upload handler bs_upload() in boot/boot_serial/src/boot_serial.c declares const struct flash_area *fap = NULL and assigns it only via flash_area_open() part-way through the function. Two early validation failures (goto out_invalid_data) — a CBOR map that fails to decode, or an upload packet missing the off/data members — branch past the open while fap is still NULL, then fall into the shared epilogue. In MCUBOOT_ENC_IMAGES builds that epilogue unconditionally calls boot_handle_enc_fw(fap), which reaches boot_image_load_header() and flash_area_read() and dereferences the NULL flash_area.

The defect is reachable pre-authentication: the trigger is the very first serial-recovery upload command carrying a malformed payload. The guarding conditions are default-true on a fresh recovery session — img_num, curr_off and img_size are zero-initialized statics, so curr_off == img_size and the primary-slot test both hold. It requires a non-default build: encrypted images (MCUBOOT_ENC_IMAGES / Zephyr CONFIG_BOOT_ENCRYPT_IMAGE) together with an active serial-recovery transport, on the Zephyr or Mynewt port (the two that build both boot/boot_serial/src/boot_serial.c and boot_serial_encryption.c with MCUBOOT_ENC_IMAGES).

The impact is a transient denial of service of the bootloader during recovery. fap is a hard NULL rather than an attacker-controlled value, so there is no memory-corruption or information-leak primitive and image authentication is unaffected. Whether the dereference faults is platform-dependent — on targets where address 0x0 is mapped readable flash the read merely returns an error and execution continues, while targets that trap NULL (MPU / null-pointer-exception detection) take a hard fault. Because serial recovery is unauthenticated by design and already permits the console attacker to write the secondary slot, the added capability is only a low-value transient crash.

The related unconditional flash_area_close(fap) call in the same epilogue is a safe no-op on the ports that reach it, so it does not contribute to the dereference.

The affected ports are the Zephyr port — boot/zephyr/CMakeLists.txt compiles boot_serial.c under CONFIG_MCUBOOT_SERIAL and boot_serial_encryption.c under CONFIG_BOOT_ENCRYPT_IMAGE — and the Mynewt port, whose mcuboot_config.h defines MCUBOOT_SERIAL unconditionally and MCUBOOT_ENC_IMAGES under any BOOTUTIL_ENCRYPT_ syscfg, with boot/boot_serial/pkg.yml declaring no explicit source list so the whole directory is built. The Espressif port is not affected**: it compiles boot_serial.c but not boot_serial_encryption.c, and defines no MCUBOOT_ENC_IMAGES, so the #ifdef MCUBOOT_ENC_IMAGES block containing the call is preprocessed away. The NuttX, Cypress and Mbed ports do not build boot_serial.c at all.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_