CVE-2026-23748
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In Golioth Firmware SDK versions 0.10.0 through 0.22.0, there is an out-of-bounds read vulnerability in LightDB State string parsing. When payload_size is less than 2, a size_t underflow occurs when computing the number of bytes to copy, and the subsequent memcpy() reads past the end of the network buffer, potentially crashing the device.
Risk Assessment
A malicious server or MITM attacker can exploit this vulnerability to cause a denial of service (DoS) on IoT devices running the affected SDK version, disrupting their operation and availability.
Recommendation
Immediately update Golioth Firmware SDK to version 0.22.0 or later, which includes the fix in commit d7f55b38. If an update is not possible, implement validation of payload_size before processing strings.
Other vulnerabilities in Golioth Firmware SDK
See all- CVE-2026-23749Low
In Golioth Firmware SDK versions 0.19.1 through 0.21.0, there is an out-of-bounds read vulnerability due to improper null termination of a blockwise transfer path. The blockwise_transfer_init() function copies the path using strncpy() without guaranteeing a trailing NUL byte, leaving the buffer unterminated. A subsequent strlen() call on this buffer can read past the allocated memory, causing a crash or denial of service.
- CVE-2026-23747Low
In Golioth Firmware SDK versions 0.10.0 through 0.22.0 (before commit 48f521b), a stack-based buffer overflow exists in Payload Utils. The golioth_payload_as_int() and golioth_payload_as_float() helpers copy network-supplied payload data into fixed-size stack buffers using memcpy() with a length derived from payload_size, with length checks only guarded by assert() which are compiled out in release builds. Payloads larger than 12 bytes (int) or 32 bytes (float) can overflow the stack, causing a crash/denial of service.
Original NVD description (English source)
Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS