CVE-2026-1998 micropython runtime.c mp_import_all memory corruption
A local attacker can exploit memory corruption in MicroPython's import function to potentially execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1998?
CVE-2026-1998 is a medium-severity memory corruption vulnerability in micropython, published on 6 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 570744d06c5ba9dba59b4c3f432ca4f0abd396b6. It is suggested to install a patch to address this issue.
Which versions are affected by CVE-2026-1998?
It affects 1 product.
Linux distribution packages (2)
micropython openSUSE:Leap 16.0 | All versions | 1.26.1-bp160.1.1 |
micropython openSUSE:Tumbleweed | All versions | 1.26.1-2.1 |
Products include Micropython Micropython.
How do I fix CVE-2026-1998?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-1998 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-1998 exists.
Other vulnerabilities in micropython
- CVE-2023-7158 MicroPython objslice.c slice_indices heap-based overflow
- CVE-2024-8946 MicroPython VFS Unmount vfs.c mp_vfs_umount heap-based overflow
- CVE-2024-8948 MicroPython objint.c mpz_as_bytes heap-based overflow
- CVE-2024-8947 MicroPython objarray.c use after free
- CVE-2023-7152 MicroPython modselect.c poll_set_add_fd use after free
Sources
Also known as DEBIAN-CVE-2026-1998, GHSA-p2vv-8mpq-57x2, UBUNTU-CVE-2026-1998, openSUSE-SU-2026:10156-1, openSUSE-SU-2026:20199-1.