CVE-2026-1998

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1998
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1998.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1998
Downstream
DEBIAN (1)
openSUSE (2)
UBUNTU (1)
Related
openSUSE (2)
Published
2026-02-06T06:02:08Z
Modified
2026-10-24T14:37:36Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
micropython runtime.c mp_import_all memory corruption
Details

A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 570744d06c5ba9dba59b4c3f432ca4f0abd396b6. It is suggested to install a patch to address this issue.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-119"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1998.json"
}
References

Affected packages

Git / github.com/dpgeorge/micropython

Affected ranges

Type
GIT
Repo
https://github.com/dpgeorge/micropython
Events
Introduced
6ec835dfef90a2f940a24b126cba8e3d8ede1ef2
Fixed
570744d06c5ba9dba59b4c3f432ca4f0abd396b6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.0"
                },
                {
                    "last_affected":  "1.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.1"
                },
                {
                    "last_affected":  "1.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.2"
                },
                {
                    "last_affected":  "1.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.3"
                },
                {
                    "last_affected":  "1.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.4"
                },
                {
                    "last_affected":  "1.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.5"
                },
                {
                    "last_affected":  "1.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.6"
                },
                {
                    "last_affected":  "1.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.7"
                },
                {
                    "last_affected":  "1.7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.8"
                },
                {
                    "last_affected":  "1.8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.9"
                },
                {
                    "last_affected":  "1.9"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.10"
                },
                {
                    "last_affected":  "1.10"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.11"
                },
                {
                    "last_affected":  "1.11"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.12"
                },
                {
                    "last_affected":  "1.12"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.13"
                },
                {
                    "last_affected":  "1.13"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.14"
                },
                {
                    "last_affected":  "1.14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.15"
                },
                {
                    "last_affected":  "1.15"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.16"
                },
                {
                    "last_affected":  "1.16"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.17"
                },
                {
                    "last_affected":  "1.17"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.18"
                },
                {
                    "last_affected":  "1.18"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.19"
                },
                {
                    "last_affected":  "1.19"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.20"
                },
                {
                    "last_affected":  "1.20"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.21"
                },
                {
                    "last_affected":  "1.21"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.22"
                },
                {
                    "last_affected":  "1.22"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.23"
                },
                {
                    "last_affected":  "1.23"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.24"
                },
                {
                    "last_affected":  "1.24"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.25"
                },
                {
                    "last_affected":  "1.25"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.26"
                },
                {
                    "last_affected":  "1.26"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.27.0"
                },
                {
                    "last_affected":  "1.27.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "570744d06c5ba9dba59b4c3f432ca4f0abd396b6"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}
Type
GIT
Repo
https://github.com/micropython/micropython
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
78ff170de9e32c79db6e64d3e33d2bd60002bdcd
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:micropython:micropython:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.27.0"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

1.*
1.0
1.1
1.10
1.11
1.12
1.13
1.14
1.15
1.16
1.17
1.18
1.19
1.2
1.20
1.21
1.22
1.23
1.24
1.25
1.26
1.27.0
1.3
1.4
1.5
1.6
1.7
1.8
1.9
v1.*
v1.0
v1.0-rc1
v1.0.1
v1.1
v1.1.1
v1.10
v1.11
v1.12
v1.13
v1.14
v1.15
v1.16
v1.17
v1.18
v1.19
v1.19.1
v1.2
v1.20.0
v1.21.0
v1.22.0
v1.22.0-preview
v1.23.0
v1.23.0-preview
v1.24.0
v1.24.0-preview
v1.25.0
v1.25.0-preview
v1.26.0
v1.26.0-preview
v1.27.0
v1.27.0-preview
v1.28.0-preview
v1.3
v1.3.1
v1.3.10
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.5
v1.5.1
v1.5.2
v1.6
v1.7
v1.8
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.9
v1.9.1
v1.9.2
v1.9.3
v1.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1998.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "314669114127214206941191837999180491419",
                "65734818014945278580344814902558745899",
                "177405024897822420457758788821448099790",
                "225847155566421643133302173562872750889",
                "234598909790281932601038328374309982589",
                "208159626100173812426223873924061901334",
                "252008842346387433472178132375686175884",
                "122239347192010381286493971473416362239",
                "7032513319386658241733258425947740844",
                "115679024746737187962769538353380490362",
                "177450214957797854408443010396088667530",
                "306912640794738765172445825369295727916",
                "50376017993905550568569054536298303313",
                "198035267221702008425483894545954342490",
                "8226933511286249839914699664771962011",
                "70388691493598608008399969543868429077"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-1998-147965e6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dpgeorge/micropython/commit/570744d06c5ba9dba59b4c3f432ca4f0abd396b6",
        "target":  {
            "file":  "py/runtime.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "30212119845419580799864898971790395502",
            "length":  785
        },
        "id":  "CVE-2026-1998-38e0d7a6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dpgeorge/micropython/commit/570744d06c5ba9dba59b4c3f432ca4f0abd396b6",
        "target":  {
            "file":  "py/runtime.c",
            "function":  "mp_import_all"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T14:37:36Z"