CVE-2026-5855
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Contiki-NG's LwM2M TLV parser in lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. A crafted CoAP WRITE with a final TLV supplying exactly one byte triggers up to five out-of-bounds reads of heap memory, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.
Risk Assessment
An attacker can disclose sensitive data from device memory, potentially leading to compromise of keys and addresses, and further attacks.
Recommendation
Update Contiki-NG to a patched version. Enable authentication in LwM2M if possible.
Other vulnerabilities in Contiki-NG
See all- CVE-2026-5857High
Contiki-NG's MQTT client in parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, the parser skips the length-reading block and performs a memcpy with an unvalidated length, leading to overflow of the topic[] buffer and overwriting adjacent fields, including the payload_chunk pointer. This can enable remote code execution on devices without memory protection.
- CVE-2026-5856High
Contiki-NG's DNS/mDNS resolver in skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() iterates nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker can set nquestions higher than the number of complete questions, causing out-of-bounds reads past the UDP packet buffer and disclosing memory contents or crashing the resolver.
- CVE-2023-34101High
Contiki-NG is an operating system for IoT devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_input_storing` function, the system does not verify that the packet buffer is large enough, which can lead to out-of-bounds reads.
- CVE-2023-34100High
Contiki-NG, an operating system for IoT devices, has a vulnerability that allows reading data out of bounds of the IPv6 buffer when processing the MSS option in TCP packets. The issue involves buffer indexing in the module os/net/ipv6/uip6.c, which may lead to unauthorized memory access.
Original NVD description (English source)
Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. Corrupted tlv_len derived from the out-of-bounds memory further corrupts the caller's parse offset. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.