CVE-2026-23748 Details
Description
Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service.
A vulnerability exists in Golioth Firmware SDK versions 0.10.0 prior to 0.22.0, involving an out-of-bounds read during LightDB State string parsing. This issue arises when a string payload's size is less than 2, leading to a size_t underflow in the calculation of bytes to copy. The resulting memcpy() operation reads beyond the end of the network buffer, potentially crashing the device. This condition can be triggered by a malicious server or a man-in-the-middle (MITM) attacker, causing a denial-of-service effect.
Users can upgrade to Golioth Firmware SDK version 0.22.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 26, 2026CISA-ADP
Assessed Feb 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Golioth Firmware SDK | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 27, 2026 | CVE Modified | [email protected] |
| Feb 26, 2026 | CVE Modified | [email protected] |
| Feb 26, 2026 | New CVE Received | [email protected] |