CVE-2026-1998: 
NixOS vulnerability analysis and mitigation

CVE-2026-1998 is a memory corruption vulnerability in MicroPython affecting the mp_import_all function in py/runtime.c. It affects all MicroPython versions up to and including 1.27.0. The flaw was reported on January 5, 2026, publicly disclosed on February 6, 2026, and patched on February 4, 2026 via commit 570744d. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, VulDB).

The root cause is that mp_import_all() incorrectly assumed its argument was always a native MicroPython module instance (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer; also classified as CWE-125: Out-of-bounds Read and CWE-787: Out-of-bounds Write). When a non-module object — such as a user-defined class returned by a custom __import__ implementation or injected via sys.modules — is passed to mp_import_all, the function attempts to retrieve the globals dictionary using mp_obj_module_get_globals(), which produces an invalid map pointer. This invalid pointer is then passed to mp_map_lookup in py/map.c:162, causing a segmentation fault (READ access to a high-value/garbage address). The fix modifies mp_import_all to use __dict__ and __all__ attribute lookups via mp_load_method_maybe() to properly handle non-module objects (GitHub Issue, GitHub PR).

Successful exploitation results in a Denial of Service (DoS) by crashing the MicroPython runtime process or causing a device reset on embedded targets. There is no direct impact on confidentiality or integrity — the vulnerability does not enable code execution, data exfiltration, or privilege escalation. On constrained embedded systems (e.g., ESP32, RP2040, STM32), a crash may require a physical reboot, making this particularly disruptive in IoT or industrial control contexts (GitHub Issue, Red Hat CVE).

A proof-of-concept exploit is publicly available in the GitHub issue report and has been referenced by VulDB (GitHub Issue, VulDB). Exploitation requires local access with low privileges and no user interaction. There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015% (very low probability of exploitation in the near term) (Feedly).

1. Prepare the environment: Obtain local access to a system running MicroPython v1.27.0 or earlier (Unix port, embedded device, etc.).
2. Craft the malicious script: Write a Python script that overrides builtins.__import__ to return a non-module object (e.g., a user-defined class), then triggers a from x import * operation:

import builtins
def custom_import(name, globals, locals, fromlist, level):
    class M:
        a = 1
    return M
builtins.__import__ = custom_import
__import__('A', None, None, None, 0)
from a import *

3. Execute the script: Run the crafted script against the vulnerable MicroPython binary (e.g., ./micropython exploit.py).
4. Trigger the crash: The from a import * statement invokes mp_import_all with the user class M instead of a native module. mp_import_all calls mp_obj_module_get_globals() on the class, producing an invalid map pointer, which is passed to mp_map_lookup, causing a segmentation fault and crashing the runtime (GitHub Issue).

• Process: Unexpected termination or crash of the MicroPython process; segmentation fault signals (SIGSEGV) from the MicroPython binary.
• Logs: System logs (e.g., dmesg, syslog) showing segfault entries for the MicroPython process; AddressSanitizer output referencing mp_map_lookup at py/map.c:162 or mp_import_all at py/runtime.c:1598.
• File System: Presence of Python scripts on the device containing patterns like builtins.__import__ = combined with from ... import * syntax targeting custom or non-module objects.
• Network/Embedded: Unexpected device resets or watchdog reboots on MicroPython-based embedded systems (ESP32, RP2040, etc.) that may indicate repeated crash-induced restarts (GitHub Issue).

The fix is included in commit 570744d06c5ba9dba59b4c3f432ca4f0abd396b6, merged into the MicroPython master branch on February 4, 2026. Users should upgrade to any MicroPython release built from master after this commit (post-v1.27.0). As a temporary workaround, restrict local system access to trusted users only to reduce the attack surface, since exploitation requires local script execution. OpenSUSE and Fedora have also issued updated packages incorporating this fix (GitHub Patch, Red Hat CVE).

The vulnerability was reported by a security researcher (handle "oneafter") via the MicroPython GitHub issue tracker on January 5, 2026, with a detailed ASAN report and proof-of-concept. MicroPython maintainer Damien George (dpgeorge) acknowledged the issue and merged a fix on February 4, 2026, noting that while the bug is uncommon in real-world code, it is worth fixing to fully support importing from non-module objects. The fix was also picked up by downstream Linux distributions including OpenSUSE and Fedora. No significant broader media coverage or social media discussion has been observed (GitHub Issue, GitHub PR).