Threats tagged 'ghsa-4mp4-cg6q-qvjw'

MCUboot's Zephyr serial-recovery upload handler bs_upload() improperly handles the img_num field from an MCUmgr image-upload request without validating its range. This allows out-of-bounds indexing into a static array, potentially causing denial of service via a bus/hard fault or unintended writes to non-image partitions. The vulnerability affects the default non-direct upload path on the Zephyr port with array-backed slot layout and is reachable by anyone with access to the unauthenticated serial/SMP recovery console. No information disclosure occurs, but integrity and availability impacts are possible.