CVE-2026-23748
MEDIUM EPSS 18.4%
Published Feb 26, 20264mo ago · Modified Apr 15, 20262mo ago
6.3 CVSS 4.0
Published Feb 26, 2026 4mo ago
Last Modified Apr 15, 2026 2mo ago
Description
Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
18.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-191
References 5
- blog.secmate.dev https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/
- github.com https://github.com/golioth/golioth-firmware-sdk/commit/d7f55b380d8be8b29bd101ce06e421af2e88c12b
- github.com https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0
- secmate.dev https://secmate.dev/disclosures/SECMATE-2025-0016
- vulncheck.com https://www.vulncheck.com/advisories/golioth-firmware-sdk-lightdb-state-out-of-bounds-read
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.