CVE-2026-127916

bootutil img hash() computes the image digest over ih hdr size + ih img size + ih protect tlv size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing earlier on the validation path bounds the whole span either: bootutil img validate() compares the image size against bootutil max image size() only after the hash has been computed.

The callers bound part of the span, or none of it:

On the swap and overwrite upgrade path, boot validate slot() first runs the image header check (boot is header valid(), later boot check header valid()). Before MCUboot 2.2.0 that check covered only ih hdr size + ih img size, so for every image the protected-TLV area (ih protect tlv size, a uint16 t, up to 65535 bytes) was hashed without being bounded. From 2.2.0 the check includes ih protect tlv size, except for a compressed image in the secondary slot when MCUBOOT DECOMPRESS IMAGES (CONFIG BOOT DECOMPRESSION) is enabled, which leaves the same gap of up to 64 KB. The serial recovery image-list and image-state handlers (bs list() and bs set() in boot/boot serial/src/boot serial.c) and Zephyr's single-slot and firmware loaders (boot/zephyr/single loader.c, boot/zephyr/firmware loader.c) call bootutil img validate() with no header check at all, so on those paths ih img size is unbounded as well.

The image is hashed before its signature is checked, so anyone who can place an image in a slot (an OTA or SMP update delivered through the application, or serial recovery) reaches this read before authentication.

Whether a malformed header produces an actual read beyond the area depends on the flash backend:

Backends whose flash area read() bounds-checks the request (Zephyr, Espressif, NuttX, Mbed) return an error once the chunked read crosses the end of the area. Validation fails and the image is rejected, with no over-read. With MCUBOOT HASH STORAGE DIRECTLY (Zephyr CONFIG BOOT IMG HASH DIRECTLY ON STORAGE, available from 2.2.0, not enabled by default) the span is hashed through a single direct pointer into memory-mapped flash, with no bounds check. The Cypress PSoC6 port's flash area read() (boot/cypress/cy flash pal/cy flash map.c, from 1.6.0) does not bound the read: its assert()s compare against the area's absolute offset rather than its size, and it copies with memcpy().

The bytes read past the area feed only the digest, which is compared internally and never returned, so nothing is disclosed. The realistic effect is a read fault during image validation: up to 64 KB past the slot on the upgrade path, and potentially much further on the paths that skip the header check. Where validation is repeated at every boot (a pending upgrade, or the single-slot loader checking its image), the fault can recur on each reset and keep the device from booting.

The fix makes bootutil img hash() add the three sizes with boot u32 safe add() and reject an image whose span, including the sector offset used in swap-using-offset mode, does not fit in the flash area, before any of it is hashed. Because the bound is applied where the bytes are read, it covers every caller.