CVE catalog

CVE-2026-1998

micropython-1.26.1-2.1 on GA media

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.23% · Oct 25, 2026

A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 570744d06c5ba9dba59b4c3f432ca4f0abd396b6. It is suggested to install a patch to address this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmicropython131.25.0+ds-1vulnerable
Debianmicropython131.26.1+ds-1vulnerable
Debianmicropython141.25.0+ds-1vulnerable
Debianmicropython141.26.1+ds-1vulnerable
Opensusemicropythonleap 16.01.26.1-bp160.1.1fixed
Opensusemicropythontumbleweed1.26.1-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Opensusemicropythonrpmleap 16.01.26.1-bp160.1.1Not reportedOPENSUSE-SU-2026:20199-1Not reported
Opensusemicropythonrpmtumbleweed1.26.1-2.1Not reportedOPENSUSE-SU-2026:10156-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [micropython]Affected
    Details (2)

    • 1.25.0+ds-1 · amd64 · trixie

      Affected

      pypi · micropython · debian · 13

    • 1.25.0+ds-1 · arm64 · trixie

      Affected

      pypi · micropython · debian · 13

  • [micropython-doc]Affected

    Source package: [micropython]

    Details (2)

    • 1.25.0+ds-1 · all · trixie

      Affected

      pypi · micropython · debian · 13

    • 1.25.0+ds-1 · all · trixie

      Affected

      pypi · micropython · debian · 13

[openSUSE Tumbleweed]

  • [mpremote]Unknown

    Source package: [micropython]

    Details (1)

    • 1.28.0-2.3 · noarch · tumbleweed

      Unknown · Fixed: 1.26.1-2.1

      Version impact unknown

      pypi · micropython · opensuse · tumbleweed

  • [mpy-tools]Unknown

    Source package: [micropython]

    Details (1)

    • 1.28.0-2.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.26.1-2.1

      Version impact unknown

      pypi · micropython · opensuse · tumbleweed

  • [micropython]Fixed

    Source package: [micropython]

    Details (1)

    • 1.28.0-2.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.26.1-2.1

      pypi · micropython · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]