CVE-2026-1998
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Feb 6, 2026
CISA due date
—
The record
A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 570744d06c5ba9dba59b4c3f432ca4f0abd396b6. It is suggested to install a patch to address this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | micropython | 0 | 1.26.1-bp160.1.1 |
| openSUSE:Tumbleweed | micropython | 0 | 1.26.1-2.1 |
Related vulnerabilities
- CVE-2024-8947 A vulnerability was found in MicroPython 1.22.2. Also affects micropython
- CVE-2023-7158 A vulnerability was found in MicroPython up to 1.21.0. Also affects micropython
- CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli… CWE-787
- CVE-2026-112397 Pillow is a Python imaging library. CWE-787
- CVE-2026-112059 libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point… CWE-787
- CVE-2026-89088 A flaw was found in parted. CWE-787
- CVE-2026-89085 A flaw was found in parted. CWE-787
- CVE-2026-85746 MariaDB server is a community developed fork of MySQL server. CWE-787