CVE-2026-127915

The MCUboot TLV iterator bootutil tlv iter next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard (it->tlv off < it->tlv end) and advances by sizeof(struct image tlv) + tlv.it len using the attacker-controlled it len field, without validating that the entry's header or payload stays within it->tlv end. As a result the 4-byte header read can extend up to 3 bytes past the declared TLV area, and the returned (off, len) can describe a payload that runs past it.

The path is pre-authentication: TLVs are parsed during bootutil img validate() before the signature is verified, and a crafted image can be presented through DFU / serial-recovery / OTA. However the impact is contained by surrounding guards: bootutil img validate() first rejects a TLV area larger than bootutil max image size(), the default LOAD IMAGE DATA sink is flash area read() which bounds-checks against the flash partition and fails an out-of-partition read, and every payload consumer (EXPECTED HASH TLV, EXPECTED KEY TLV, EXPECTED SIG TLV, IMAGE TLV SEC CNT) clamps len against a fixed buffer before copying.

The residual effect in a default flash build is therefore an out-of-region read confined to the attacker's own slot partition whose result is never observable, yielding at worst a clean validation failure rather than memory corruption or information disclosure. A genuine (though still bounded) out-of-bounds read remains under the non-default MCUBOOT RAM LOAD configuration, where LOAD IMAGE DATA is an unchecked memcpy. The fix is to validate each entry's header and payload against it->tlv end inside the iterator.