CVE-2026-23749
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In Golioth Firmware SDK versions 0.19.1 through 0.21.0, there is an out-of-bounds read vulnerability due to improper null termination of a blockwise transfer path. The blockwise_transfer_init() function copies the path using strncpy() without guaranteeing a trailing NUL byte, leaving the buffer unterminated. A subsequent strlen() call on this buffer can read past the allocated memory, causing a crash or denial of service.
Risk Assessment
The risk is that an application can trigger a system crash, leading to device unavailability. The vulnerability is application-controlled, not network-triggered by default, which limits remote exploitation but can be exploited locally if misconfigured.
Recommendation
Upgrade Golioth Firmware SDK to version 0.22.0 or later, which includes the fix in commit 0e788217. If an upgrade is not possible, ensure proper null termination of the path in the application code.
Other vulnerabilities in Golioth Firmware SDK
See all- CVE-2026-23748Low
In Golioth Firmware SDK versions 0.10.0 through 0.22.0, there is an out-of-bounds read vulnerability in LightDB State string parsing. When payload_size is less than 2, a size_t underflow occurs when computing the number of bytes to copy, and the subsequent memcpy() reads past the end of the network buffer, potentially crashing the device.
- CVE-2026-23747Low
In Golioth Firmware SDK versions 0.10.0 through 0.22.0 (before commit 48f521b), a stack-based buffer overflow exists in Payload Utils. The golioth_payload_as_int() and golioth_payload_as_float() helpers copy network-supplied payload data into fixed-size stack buffers using memcpy() with a length derived from payload_size, with length checks only guarded by assert() which are compiled out in release builds. Payloads larger than 12 bytes (int) or 32 bytes (float) can overflow the stack, causing a crash/denial of service.
Original NVD description (English source)
Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS