CVE-2026-16671

split image check() in boot/bootutil/src/loader.c declares a fixed uint8 t loader hash[32] buffer and passes it as the out hash out-parameter to bootutil img validate(). That routine copies IMAGE HASH SIZE bytes into out hash (memcpy(out hash, hash, IMAGE HASH SIZE) in boot/bootutil/src/image validate.c), where IMAGE HASH SIZE is a compile-time constant of 64 for MCUBOOT SHA512 or 48 for MCUBOOT SIGN EC384/SHA-384 (boot/bootutil/include/bootutil/crypto/sha.h). The buffer tracks SHA-256 (32 bytes) while the copy length tracks the configured algorithm, so the write overruns the buffer by 16 or 32 bytes.

The overflow is only present in a non-default configuration: the legacy Mynewt split-image feature must be compiled (split go()/split image check(), i.e. neither MCUBOOT DIRECT XIP nor MCUBOOT RAM LOAD), the digest must be larger than 32 bytes (MCUBOOT SHA512 or MCUBOOT SIGN EC384), and MCUBOOT SIGN PURE must be off. split go() is a public API with no caller inside MCUboot; it is invoked from a Mynewt application. In the default SHA-256 build there is no overflow.

The over-written bytes are the one-way digest of the loader image and the overflow length is fixed at build time, so the contents are not meaningfully attacker-controlled and the size is not attacker-chosen. The realistic impact is bounded, uncontrolled corruption of the bootloader's stack on the split-boot path, manifesting as instability or failed boot in the affected configuration rather than reliable code execution. The fix is to size loader hash to IMAGE HASH SIZE and pass IMAGE HASH SIZE as the matching seed length.