# CVE-2026-16659: MCUboot serial-recovery NULL pointer dereference in encryption handler

Source: https://junglewise.ai/threats/cve-2026-16659-mcuboot-s-serial-recovery-image-upload-handler-bs-upload-in-boot  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-13. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-16659 · Severity: medium · CVSS 4 · Published 2026-11-13

MCUboot is a secure bootloader used to load firmware on embedded devices. During serial recovery mode (used to update firmware over a serial connection), a malformed upload packet can trigger a NULL pointer dereference in encrypted-image builds, causing the bootloader to crash or hang. Recovery mode is unauthenticated by design, so an attacker with physical or console access can trigger this denial of service.

Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-16659 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16659 being exploited in the wild.

**How severe is CVE-2026-16659?** Medium severity, with a CVSS score of 4, published 13 November 2026.

**Which products and versions are affected?** Apache MCUboot all versions with Mynewt port and MCUBOOT_ENC_IMAGES enabled; Zephyr MCUboot all versions with Zephyr port, CONFIG_MCUBOOT_SERIAL and CONFIG_BOOT_ENCRYPT_IMAGE enabled.

**Is there a fix for CVE-2026-16659?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16659 attacked?** It is attacked with physical access or with local access, in device firmware.

**Am I affected by CVE-2026-16659?** Check whether you run Apache MCUboot or Zephyr MCUboot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The bs_upload() function in boot_serial.c declares a flash_area pointer initialized to NULL and only assigns it via flash_area_open() partway through execution. Two early validation failures (malformed CBOR or missing packet fields) use goto to skip the open call but proceed to the epilogue, where MCUBOOT_ENC_IMAGES builds unconditionally call boot_handle_enc_fw(fap) with a NULL pointer. This reaches flash_area_read() and dereferences the NULL value. The vulnerability is reachable pre-authentication on the first upload command with default zero-initialized state variables; impact ranges from transient faults on targets with NULL-pointer detection to continued execution on platforms where address 0x0 is readable flash.

## Affected products

- Zephyr MCUboot all versions with Zephyr port, CONFIG_MCUBOOT_SERIAL and CONFIG_BOOT_ENCRYPT_IMAGE enabled
- Apache MCUboot all versions with Mynewt port and MCUBOOT_ENC_IMAGES enabled

## Timeline

- 2026-11-13: disclosed