Vulnerability Description
A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 570744d06c5ba9dba59b4c3f432ca4f0abd396b6. It is suggested to install a patch to address this issue.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Micropython | Micropython | <= 1.27.0 |
Related Weaknesses (CWE)
References
- https://github.com/dpgeorge/micropython/commit/570744d06c5ba9dba59b4c3f432ca4f0aPatch
- https://github.com/micropython/micropython/Product
- https://github.com/micropython/micropython/issues/18639ExploitIssue Tracking
- https://github.com/micropython/micropython/issues/18639#issue-3780651410ExploitIssue Tracking
- https://github.com/micropython/micropython/pull/18671ExploitIssue Tracking
- https://vuldb.com/?ctiid.344546Permissions RequiredVDB Entry
- https://vuldb.com/?id.344546Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.743396ExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2026-1998?
CVE-2026-1998 is a vulnerability with a CVSS score of 3.3 (LOW). A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be la...
How severe is CVE-2026-1998?
CVE-2026-1998 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-1998?
Check the references section above for vendor advisories and patch information. Affected products include: Micropython Micropython.