A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 570744d06c5ba9dba59b4c3f432ca4f0abd396b6. It is suggested to install a patch to address this issue.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d619d8d077 advisory.

    Automatic update for micropython-1.28.0-1.fc45.

    ##### **Changelog**

    ```
    * Mon Apr  6 2026 Lumr Balhar <lbalhar@redhat.com> - 1.28.0-1
    - Update to 1.28.0
    - Security fix for CVE-2026-1998
    - Update mbedtls submodule to 3.6.6
    - mbedtls security fixes for CVE-2026-25834, CVE-2026-34871, CVE-2026-25833
    - CVE-2025-52496, CVE-2025-52497, CVE-2025-49087, CVE-2025-54764, CVE-2025-59438      Resolves: rhbz#2455368, rhbz#2376688, rhbz#2376701, rhbz#2382261, rhbz#2405245,      rhbz#2405374, rhbz#2437327, rhbz#2454032, rhbz#2454086, rhbz#2454213

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20199-1 advisory.

    Changes in micropython:

    - CVE-2026-1998: Fixed segmentation fault in `mp_map_lookup` via `mp_import_all` (bsc#1257803).

    - Version 1.26.1
      * esp32: update esp_tinyusb component to v1.7.6
      * tools: add an environment variable MICROPY_MAINTAINER_BUILD
      * esp32: add IDF Component Lockfiles to git repo
      * shared/tinyusb: fix hang from new tx_overwritabe_if_not_connected flag
      * shared/tinyusb/mp_usbd_cdc: rewrite USB CDC TX loop
      * tools/mpremote: don't apply Espressif DTR/RTS quirk to TinyUSB CDC dev

    - Fix building on single core systems
      * Skip tests/thread/stress_schedule.py when single core system detected

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all     of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be launched     locally. The exploit has been published and may be used. Patch name:
    570744d06c5ba9dba59b4c3f432ca4f0abd396b6. It is suggested to install a patch to address this issue.
    (CVE-2026-1998)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
306036	Fedora 45 : micropython (2026-d619d8d077)	Nessus	Fedora Local Security Checks	medium
298933	openSUSE 16 Security Update : micropython (openSUSE-SU-2026:20199-1)	Nessus	SuSE Local Security Checks	medium
298197	Linux Distros Unpatched Vulnerability : CVE-2026-1998	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-1998

medium

Tenable Plugins

medium

medium

medium