CVE-2026-16671: Out-of-bounds stack write in MCUboot split-image validation with SHA-384/SHA-512 builds

splitimagecheck() in boot/bootutil/src/loader.c declares a fixed uint8t loaderhash[32] buffer and passes it as the outhash out-parameter to bootutilimgvalidate(). That routine copies IMAGEHASHSIZE bytes into outhash (memcpy(outhash, hash, IMAGEHASHSIZE) in boot/bootutil/src/imagevalidate.c), where IMAGEHASHSIZE is a compile-time constant of 64 for MCUBOOTSHA512 or 48 for MCUBOOTSIGNEC384/SHA-384 (boot/bootutil/include/bootutil/crypto/sha.h). The buffer tracks SHA-256 (32 bytes) while the copy length tracks the configured algorithm, so the write overruns the buffer by 16 or 32 bytes.

The overflow is only present in a non-default configuration: the legacy Mynewt split-image feature must be compiled (splitgo()/splitimagecheck(), i.e. neither MCUBOOTDIRECTXIP nor MCUBOOTRAMLOAD), the digest must be larger than 32 bytes (MCUBOOTSHA512 or MCUBOOTSIGNEC384), and MCUBOOTSIGNPURE must be off. splitgo() is a public API with no caller inside MCUboot; it is invoked from a Mynewt application. In the default SHA-256 build there is no overflow.

The over-written bytes are the one-way digest of the loader image and the overflow length is fixed at build time, so the contents are not meaningfully attacker-controlled and the size is not attacker-chosen. The realistic impact is bounded, uncontrolled corruption of the bootloader's stack on the split-boot path, manifesting as instability or failed boot in the affected configuration rather than reliable code execution. The fix is to size loaderhash to IMAGEHASHSIZE and pass IMAGEHASHSIZE as the matching seed length.