p PatchFirst

CVE-2026-1998

CVE-2026-1998 · micropython runtime.c mp_import_all memory corruption

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 570744d06c5ba9dba59b4c3f432ca4f0abd396b6. It is suggested to install a patch to address this issue.

CVSS 4.8 · Medium · EPSS 0.2%

Published
Updated

Stack: system

Affected products and versions

  • micropython

    Versions
    • 1.0: Affected
    • 1.1: Affected
    • 1.2: Affected
    • 1.3: Affected
    • 1.4: Affected
    • 1.5: Affected
    • 1.6: Affected
    • 1.7: Affected
    • 1.8: Affected
    • 1.9: Affected
    • 1.10: Affected
    • 1.11: Affected
    • 1.12: Affected
    • 1.13: Affected
    • 1.14: Affected
    • 1.15: Affected
    • 1.16: Affected
    • 1.17: Affected
    • 1.18: Affected
    • 1.19: Affected
    • 1.20: Affected
    • 1.21: Affected
    • 1.22: Affected
    • 1.23: Affected
    • 1.24: Affected
    • 1.25: Affected
    • 1.26: Affected
    • 1.27.0: Affected

    No fix published

  • micropython Debian:13

    Versions
    • 1.25.0+ds-1
    • 1.26.1+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • micropython Debian:14

    Versions
    • 1.25.0+ds-1
    • 1.26.1+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • micropython Ubuntu:Pro:20.04:LTS

    Versions
    • 1.12-1
    • 1.12-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • micropython Ubuntu:Pro:22.04:LTS

    Versions
    • 1.17+ds-1ubuntu1
    • 1.17+ds-1.1
    • 1.17+ds-1.1ubuntu2
    • 1.17+ds-1.1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • micropython Ubuntu:Pro:24.04:LTS

    Versions
    • 1.19.1+ds-1
    • 1.22.1+ds-1
    • 1.22.1+ds-1build1
    • 1.22.1+ds-1build2
    • 1.22.1+ds-1ubuntu0.24.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • micropython Ubuntu:25.10

    Versions
    • 1.24.1+ds-1
    • 1.25.0+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • micropython Ubuntu:26.10

    Versions
    • 1.26.1+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • micropython Ubuntu:26.04:LTS

    Versions
    • 1.25.0+ds-1
    • 1.26.1+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →