Product by Mcu-tools
Mcuboot
9 known vulnerabilities in Mcuboot (Mcu-tools), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2026-16664 | Unchecked serial-recovery image index causes out-of-bounds slot-table read in MCUboot Zephyr port | 5.1 | |
| Medium | CVE-2026-16659 | Mcu-tools Mcuboot: NULL Pointer Dereference | 4.0 | |
| Low | CVE-2026-16671 | Out-of-bounds stack write in MCUboot split-image validation with SHA-384/SHA-512 builds | 2.9 | |
| Low | CVE-2026-127916 | Mcu-tools Mcuboot: Out-of-bounds Read | 2.9 | |
| High | CVE-2024-32883 | MCUboot Injection attack of unprotected TLV values | 7.7 | |
| Low | CVE-2026-16662 | Mcu-tools Mcuboot: Use of Uninitialized Variable | 2.4 | |
| Low | CVE-2026-128091 | AES key schedule not cleared by the TinyCrypt AES-CTR backend in MCUboot bootutil | 2.0 | |
| Low | CVE-2026-127928 | AES image key left on the stack after serial-recovery encrypted-image handling in MCUboot | 2.0 | |
| Low | CVE-2026-127915 | TLV iterator does not bound each entry against the declared TLV area in MCUboot bootutil | 2.0 |