CVE-2026-5855 Details
Description
Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. Corrupted tlv_len derived from the out-of-bounds memory further corrupts the caller's parse offset. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.
A vulnerability in Contiki-NG's LwM2M TLV parser allows for out-of-bounds reads of heap memory. The issue arises in the function 'lwm2m_tlv_read()' within 'os/services/lwm2m/lwm2m-tlv.c', where the parser ignores the caller-supplied buffer length and reads up to six bytes without proper bounds checking. This flaw can be exploited by sending a crafted CoAP WRITE to an LwM2M endpoint, triggering the parser to read adjacent memory and potentially disclose sensitive information such as key material and peer addresses. The vulnerability is present in LwM2M NoSec mode, which is the default for constrained devices, requiring no authentication.
Users can update to the latest version of Contiki-NG, where this vulnerability has been addressed. Instructions for updating can be found in the Contiki-NG GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/contiki-ng/contiki-ng | [email protected] | Vendor |
| https://github.com/contiki-ng/contiki-ng/commit/f1673b5766d4d4d514cefb8a0350f43653574997 | [email protected] | Source CodeVendor |
| https://github.com/contiki-ng/contiki-ng/pull/3165 | [email protected] | Issue TrackingSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Contiki-NG | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |