PT-2026-6683 · Unknown · Micropython

Oneafter · Published 2026-02-06 · Updated 2026-02-11 · CVE-2026-1998

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions micropython versions prior to 1.27.0

Description A flaw exists in micropython up to version 1.27.0. This issue is related to memory corruption caused by manipulation of the mp import all function within the py/runtime.c file. The attack requires local access. An exploit for this issue has been published.

Recommendations Install the patch 570744d06c5ba9dba59b4c3f432ca4f0abd396b6 to address this issue.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

CVE-2026-1998

OPENSUSE-SU-2026:10156-1

OPENSUSE-SU-2026:20199-1

Affected Products

Micropython

References · 22

• 🔥 https://github.com/micropython/micropython/pull/18671 · Exploit
• 🔥 https://github.com/micropython/micropython/issues/18639 · Exploit
• 🔥 https://github.com/micropython/micropython/issues/18639#issue-3780651410 · Exploit
• 🔥 https://vuldb.com/?submit.743396 · Exploit
• https://github.com/dpgeorge/micropython/commit/570744d06c5ba9dba59b4c3f432ca4f0abd396b6 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10156-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1998 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1998 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1998 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-1998 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20199-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-1998 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-1998 · Security Note
• https://suse.com/security/cve/CVE-2026-1998 · Note