Threats tagged 'ghsa-6xxp-cfwm-wjvg'

CVE-2026-16671 is a low-severity buffer overflow vulnerability in MCUboot's split_image_check() function when using non-default configurations with larger digest sizes (SHA-512 or EC384). The fixed 32-byte buffer loader_hash is overflowed by 16 or 32 bytes due to a mismatch with the configured hash size, causing stack corruption. This can lead to boot instability or failure but does not allow attacker-controlled code execution.