CVE-2026-1998

Friday, February 06, 2026

4.8

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Summary

A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 570744d06c5ba9dba59b4c3f432ca4f0abd396b6. It is suggested to install a patch to address this issue.

Affected Software

Vendor	Product	Version Range	Status
n/a	micropython	`1.0`	affected
n/a	micropython	`1.1`	affected
n/a	micropython	`1.2`	affected
n/a	micropython	`1.3`	affected
n/a	micropython	`1.4`	affected
n/a	micropython	`1.5`	affected
n/a	micropython	`1.6`	affected
n/a	micropython	`1.7`	affected
n/a	micropython	`1.8`	affected
n/a	micropython	`1.9`	affected
n/a	micropython	`1.10`	affected
n/a	micropython	`1.11`	affected
n/a	micropython	`1.12`	affected
n/a	micropython	`1.13`	affected
n/a	micropython	`1.14`	affected
n/a	micropython	`1.15`	affected
n/a	micropython	`1.16`	affected
n/a	micropython	`1.17`	affected
n/a	micropython	`1.18`	affected
n/a	micropython	`1.19`	affected
n/a	micropython	`1.20`	affected
n/a	micropython	`1.21`	affected
n/a	micropython	`1.22`	affected
n/a	micropython	`1.23`	affected
n/a	micropython	`1.24`	affected
n/a	micropython	`1.25`	affected
n/a	micropython	`1.26`	affected
n/a	micropython	`1.27.0`	affected

Weaknesses

CWE-119: Memory Corruption

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: poc
- Automatable: no
- Technical Impact: partial

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.