Is CVE-2026-16659 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16659 being exploited in the wild.

How severe is CVE-2026-16659?

Medium severity, with a CVSS score of 4, published 13 November 2026.

Which products and versions are affected?

Apache MCUboot all versions with Mynewt port and MCUBOOT_ENC_IMAGES enabled; Zephyr MCUboot all versions with Zephyr port, CONFIG_MCUBOOT_SERIAL and CONFIG_BOOT_ENCRYPT_IMAGE enabled.

Is there a fix for CVE-2026-16659?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16659 attacked?

It is attacked with physical access or with local access, in device firmware.

Am I affected by CVE-2026-16659?

Check whether you run Apache MCUboot or Zephyr MCUboot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16659: MCUboot serial-recovery NULL pointer dereference in encryption handler

CVE-2026-16659 · Severity: medium · CVSS 4 · Published 2026-11-13

MCUboot is a secure bootloader used to load firmware on embedded devices. During serial recovery mode (used to update firmware over a serial connection), a malformed upload packet can trigger a NULL pointer dereference in encrypted-image builds, causing the bootloader to crash or hang. Recovery mode is unauthenticated by design, so an attacker with physical or console access can trigger this denial of service.

Vendors: Apache, Zephyr.

Quick answers

Is CVE-2026-16659 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16659 being exploited in the wild.
How severe is CVE-2026-16659?: Medium severity, with a CVSS score of 4, published 13 November 2026.
Which products and versions are affected?: Apache MCUboot all versions with Mynewt port and MCUBOOT_ENC_IMAGES enabled; Zephyr MCUboot all versions with Zephyr port, CONFIG_MCUBOOT_SERIAL and CONFIG_BOOT_ENCRYPT_IMAGE enabled.
Is there a fix for CVE-2026-16659?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16659 attacked?: It is attacked with physical access or with local access, in device firmware.
Am I affected by CVE-2026-16659?: Check whether you run Apache MCUboot or Zephyr MCUboot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The bs_upload() function in boot_serial.c declares a flash_area pointer initialized to NULL and only assigns it via flash_area_open() partway through execution. Two early validation failures (malformed CBOR or missing packet fields) use goto to skip the open call but proceed to the epilogue, where MCUBOOT_ENC_IMAGES builds unconditionally call boot_handle_enc_fw(fap) with a NULL pointer. This reaches flash_area_read() and dereferences the NULL value. The vulnerability is reachable pre-authentication on the first upload command with default zero-initialized state variables; impact ranges from transient faults on targets with NULL-pointer detection to continued execution on platforms where address 0x0 is readable flash.

Affected products

Zephyr MCUboot all versions with Zephyr port, CONFIG_MCUBOOT_SERIAL and CONFIG_BOOT_ENCRYPT_IMAGE enabled
Apache MCUboot all versions with Mynewt port and MCUBOOT_ENC_IMAGES enabled

Timeline

2026-11-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.