{"id":"CVE-2026-16659","summary":"Pre-authentication NULL pointer dereference in MCUboot serial-recovery image upload (encrypted-image builds)","details":"MCUboot's serial-recovery image-upload handler bs_upload() in boot/boot_serial/src/boot_serial.c declares const struct flash_area *fap = NULL and assigns it only via flash_area_open() part-way through the function. Two early validation failures (goto out_invalid_data) — a CBOR map that fails to decode, or an upload packet missing the off/data members — branch past the open while fap is still NULL, then fall into the shared epilogue. In MCUBOOT_ENC_IMAGES builds that epilogue unconditionally calls boot_handle_enc_fw(fap), which reaches boot_image_load_header() and flash_area_read() and dereferences the NULL flash_area.\n\nThe defect is reachable pre-authentication: the trigger is the very first serial-recovery upload command carrying a malformed payload. The guarding conditions are default-true on a fresh recovery session — img_num, curr_off and img_size are zero-initialized statics, so curr_off == img_size and the primary-slot test both hold. It requires a non-default build: encrypted images (MCUBOOT_ENC_IMAGES / Zephyr CONFIG_BOOT_ENCRYPT_IMAGE) together with an active serial-recovery transport, on the Zephyr or Mynewt port (the two that build both boot/boot_serial/src/boot_serial.c and boot_serial_encryption.c with MCUBOOT_ENC_IMAGES).\n\nThe impact is a transient denial of service of the bootloader during recovery. fap is a hard NULL rather than an attacker-controlled value, so there is no memory-corruption or information-leak primitive and image authentication is unaffected. Whether the dereference faults is platform-dependent — on targets where address 0x0 is mapped readable flash the read merely returns an error and execution continues, while targets that trap NULL (MPU / null-pointer-exception detection) take a hard fault. Because serial recovery is unauthenticated by design and already permits the console attacker to write the secondary slot, the added capability is only a low-value transient crash.\n\nThe related unconditional flash_area_close(fap) call in the same epilogue is a safe no-op on the ports that reach it, so it does not contribute to the dereference.\n\nThe affected ports are the Zephyr port — boot/zephyr/CMakeLists.txt compiles boot_serial.c under CONFIG_MCUBOOT_SERIAL and boot_serial_encryption.c under CONFIG_BOOT_ENCRYPT_IMAGE — and the Mynewt port, whose mcuboot_config.h defines MCUBOOT_SERIAL unconditionally and MCUBOOT_ENC_IMAGES under any BOOTUTIL_ENCRYPT_ syscfg, with boot/boot_serial/pkg.yml declaring no explicit source list so the whole directory is built. The Espressif port is not affected**: it compiles boot_serial.c but not boot_serial_encryption.c, and defines no MCUBOOT_ENC_IMAGES, so the #ifdef MCUBOOT_ENC_IMAGES block containing the call is preprocessed away. The NuttX, Cypress and Mbed ports do not build boot_serial.c at all.","aliases":["GHSA-777r-3chm-p78c"],"modified":"2026-11-13T13:10:16.137875166Z","published":"2026-11-13T00:23:03.881Z","database_specific":{"cwe_ids":["CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16659.json","cna_assigner":"zephyr"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16659.json"},{"type":"PACKAGE","url":"https://github.com/mcu-tools/mcuboot"},{"type":"FIX","url":"https://github.com/mcu-tools/mcuboot/commit/400f9a7242641655948b08acac19932f56d9881f"},{"type":"ADVISORY","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-777r-3chm-p78c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16659"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mcu-tools/mcuboot","events":[{"introduced":"304fd41980ed929533b9f387dde1b463b0be5b90"},{"fixed":"725d63c9d5bc1bb572d802e7a768daf504186daf"},{"fixed":"400f9a7242641655948b08acac19932f56d9881f"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.0.0"},{"fixed":"2.5.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"400f9a7242641655948b08acac19932f56d9881f"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v2.4.0","v2.4.0-rc1","v2.3.0","v2.3.0-rc2","v2.3.0-rc1","v2.2.0","v2.2.0-rc2","v2.2.0-rc1","v2.1.0","v2.1.0-rc1","v2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16659.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["28050526899302654610454675477715678284","134272626696233410601719333201558183771","247534745136625241024845696793060625307","95703866684607992121168649900918513485","295690176732886606426098301673477353858","260608413718533147513590242279481522797","336789681572629686505786574599974810837","37361958199446007395484722292497511673","219749758276203539623451234632289480816","45595251105156727714489022826161668253","14180590291571922814292143036118253684"],"threshold":0.9},"id":"CVE-2026-16659-43746adf","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcu-tools/mcuboot/commit/400f9a7242641655948b08acac19932f56d9881f","target":{"file":"boot/boot_serial/src/boot_serial.c"}},{"digest":{"function_hash":"106085736703137426434609676159520816128","length":5559},"id":"CVE-2026-16659-74dde6c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcu-tools/mcuboot/commit/400f9a7242641655948b08acac19932f56d9881f","target":{"file":"boot/boot_serial/src/boot_serial.c","function":"bs_upload"},"deprecated":false}],"vanir_signatures_modified":"2026-11-13T13:10:16Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}