CVE-2026-16664

MCUboot's Zephyr serial-recovery upload handler bs upload() in boot/boot serial/src/boot serial.c decodes the host-supplied image field of an MCUmgr image-upload request into img num (a full 32-bit value) and latches it on the off == 0 packet without any range check. It then passes img num straight to flash area id from multi image slot(img num, 0), which on the Zephyr port resolves to flash area ids for slot() in boot/zephyr/include/sysflash/sysflash.h and indexes the static const int all slots[] table as all slots[img num 2]. That table holds only MCUBOOT IMAGE NUMBER 2 entries, so any img num >= MCUBOOT IMAGE NUMBER is an out-of-bounds read.

The path is reachable by anyone with access to the serial / SMP recovery console, which is unauthenticated by design, and the bad value is supplied before any image signature is verified. The defect is specific to the default non-direct upload path (MCUBOOT SERIAL DIRECT IMAGE UPLOAD disabled) on the Zephyr port with the array-backed slot layout (not CONFIG SINGLE APPLICATION SLOT). It is not gated on a multi-image configuration: MCUBOOT IMAGE NUMBER defaults to 1, so even a default single-image build is affected for any image >= 1. The MCUBOOT SERIAL DIRECT IMAGE UPLOAD path is safe (its flash area id from direct image() switch returns -EINVAL for unknown indices).

flash area id from multi image slot() takes a signed int image index while img num is uint32 t, so the attacker controls the sign of the index as well as its magnitude: an image of 0xFFFFFFFF converts to -1 and reads all slots[-2], off the front of the table, while large positive values read off the end (CWE-192). Either way the index multiply img * 2 is performed in int, so a wild offset yields a bus/hard fault, giving a reliable denial of service of the bootloader during recovery. For moderately out-of-range indices the read returns adjacent .rodata as a garbage flash-area id that is handed to flash area open(); this normally fails with MGMT ERR EINVAL, but if the garbage id happens to match a valid non-image partition, the subsequent erase/write can target a partition outside the image set (CWE-787). The attacker-supplied value is never echoed back, so there is no information disclosure. The fix is to reject img num >= BOOT IMAGE NUMBER on the off == 0 packet, before the slot lookup. The comparison must be made on the unsigned img num: an equivalent guard applied after the conversion to int would not reject the negative case above. flash area ids for slot() should bounds-check its own arguments as defence in depth. This vulnerability was reported independently twice: by NVIDIA Project Vanessa on 2026-06-22, and by Kai Phan (@kaimandalic) on 2026-07-19 as GHSA-8v33-88p6-jffj, which is closed as a duplicate of this advisory. Both original reports are reproduced in full below.