CVE-2026-23748
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In Golioth Firmware SDK versions 0.10.0 through 0.22.0, there is an out-of-bounds read vulnerability in LightDB State string parsing. When payload_size is less than 2, a size_t underflow occurs when computing the number of bytes to copy, and the subsequent memcpy() reads past the end of the network buffer, potentially crashing the device.
Risk Assessment
A malicious server or MITM attacker can exploit this vulnerability to cause a denial of service (DoS) on IoT devices running the affected SDK version, disrupting their operation and availability.
Recommendation
Immediately update Golioth Firmware SDK to version 0.22.0 or later, which includes the fix in commit d7f55b38. If an update is not possible, implement validation of payload_size before processing strings.
Original NVD description (English source)
Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service.