A flaw was identified in MicroPython versions up to 1.27.0 that targets the mp_import_all function within py/runtime.c. Manipulating this function can corrupt memory in the interpreter. The impact of this memory corruption could lead to a crash of the interpreter or, at a minimum, an unauthorized manipulation of internal state. The CVE description does not explicitly confirm arbitrary code execution, but the nature of the flaw and the fact that an exploit has been published indicate a significant risk if an attacker can trigger it.

MicroPython, a lightweight Python interpreter for embedded devices, is affected for all releases up to and including 1.27.0. The vulnerability is catalogued in the CPE database under cpe:2.3:a:micropython:micropython:*:*:*:*:*:*:* and is relevant to any deployment that runs the mp_import_all routine locally.

The CVSS score of 4.8 classifies this as a moderate severity issue. The EPSS score is reported as <1%, indicating a low probability of exploitation in the wild; however, the vulnerability is not listed in the CISA KEV catalog. The attack vector requires local access, meaning an adversary must execute code or input data directly on the device hosting the MicroPython interpreter. Exploit code is publicly available on GitHub, and the corresponding patch has been committed, but the lack of a high EPSS suggests that widespread exploitation has not yet occurred. Nonetheless, the possibility of a local attacker using the flaw to corrupt memory—potentially leading to a denial of service or upstream impact on co-located processes—warrants prompt remedial action.