MicroPython Memory Corruption Vulnerability in Import Handling

A memory corruption vulnerability has been identified in MicroPython versions prior to 1.27.0. The issue arises in the 'mp_import_all' function within 'py/runtime.c', where the import mechanism incorrectly processes certain object types, leading to a segmentation fault. This vulnerability requires local exploitation and has been assigned CVE-2026-1998.

Impact

Exploitation of this vulnerability causes a segmentation fault, crashing the MicroPython runtime. This disruption can lead to a denial-of-service condition, where the process terminates or the device resets.

Reproduction

The vulnerability can be reproduced by compiling MicroPython with the GCC compiler, enabling AddressSanitizer, and then executing a script that uses 'from <malformed_obj> import *' syntax. This can be done by injecting a user-defined class into the import system that does not conform to expected module structures.

Remediation

Users are advised to update to MicroPython version 1.27.0 or later, where this vulnerability has been fixed.