CVE-2026-23748

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23748", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-15T18:42:20.937Z", "datePublished": "2026-02-26T17:31:32.584Z", "dateUpdated": "2026-11-08T14:01:24.257Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:01:24.257Z"}, "title": "Golioth Firmware SDK < 0.22.0 LightDB State Out-of-Bounds Read", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Golioth Firmware SDK version&nbsp;0.10.0 prior to 0.22.0, fixed in commit&nbsp;d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service."}], "value": "Golioth Firmware SDK version\u00a00.10.0 prior to 0.22.0, fixed in commit\u00a0d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)", "lang": "en", "type": "CWE"}]}], "affected": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/golioth/golioth-firmware-sdk", "product": "Firmware SDK", "repo": "https://github.com/golioth/golioth-firmware-sdk", "vendor": "Golioth", "versions": [{"lessThan": "0.22.0", "status": "affected", "version": "0.10.0", "versionType": "semver"}, {"status": "unaffected", "version": "d7f55b380d8be8b29bd101ce06e421af2e88c12b", "versionType": "git"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "references": [{"tags": ["technical-description"], "url": "https://secmate.dev/disclosures/SECMATE-2025-0016"}, {"tags": ["technical-description", "exploit"], "url": "https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/"}, {"tags": ["release-notes"], "url": "https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0", "name": "Firmware SDK 0.22.0 Release Notes"}, {"tags": ["patch"], "url": "https://github.com/golioth/golioth-firmware-sdk/commit/d7f55b380d8be8b29bd101ce06e421af2e88c12b"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/golioth-firmware-sdk-lightdb-state-out-of-bounds-read"}], "credits": [{"lang": "en", "type": "finder", "value": "SecMate (https://secmate.dev)"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T16:06:13.053978Z", "id": "CVE-2026-23748", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T16:06:24.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23748", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T16:06:13.053978Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T16:06:18.488Z"}}], "cna": {"title": "Golioth Firmware SDK < 0.22.0 LightDB State Out-of-Bounds Read", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "SecMate (https://secmate.dev)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/golioth/golioth-firmware-sdk", "vendor": "Golioth", "product": "Firmware SDK", "versions": [{"status": "affected", "version": "0.10.0", "lessThan": "0.22.0", "versionType": "semver"}, {"status": "unaffected", "version": "d7f55b380d8be8b29bd101ce06e421af2e88c12b", "versionType": "git"}], "packageURL": "pkg:github/golioth/golioth-firmware-sdk", "defaultStatus": "unaffected"}], "references": [{"url": "https://secmate.dev/disclosures/SECMATE-2025-0016", "tags": ["technical-description"]}, {"url": "https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0", "name": "Firmware SDK 0.22.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/golioth/golioth-firmware-sdk/commit/d7f55b380d8be8b29bd101ce06e421af2e88c12b", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/golioth-firmware-sdk-lightdb-state-out-of-bounds-read", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Golioth Firmware SDK version\u00a00.10.0 prior to 0.22.0, fixed in commit\u00a0d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service.", "supportingMedia": [{"type": "text/html", "value": "Golioth Firmware SDK version&nbsp;0.10.0 prior to 0.22.0, fixed in commit&nbsp;d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:01:24.257Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23748", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:01:24.257Z", "dateReserved": "2026-01-15T18:42:20.937Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-26T17:31:32.584Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/golioth/golioth-firmware-sdk", "product": "Firmware SDK", "repo": "https://github.com/golioth/golioth-firmware-sdk", "vendor": "Golioth", "versions": [{"lessThan": "0.22.0", "status": "affected", "version": "0.10.0", "versionType": "semver"}, {"status": "unaffected", "version": "d7f55b380d8be8b29bd101ce06e421af2e88c12b", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Golioth Firmware SDK version\u00a00.10.0 prior to 0.22.0, fixed in commit\u00a0d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service."}, {"lang": "es", "value": "Golioth Firmware SDK versi\u00f3n 0.10.0 anterior a la 0.22.0, corregida en el commit d7f55b38, contienen una lectura fuera de l\u00edmites en el an\u00e1lisis de cadenas de LightDB State. Al procesar una carga \u00fatil de cadena, un valor de payload_size inferior a 2 puede causar un underflow de size_t al calcular el n\u00famero de bytes a copiar (nbytes). El memcpy() subsiguiente lee m\u00e1s all\u00e1 del final del b\u00fafer de red, lo que puede bloquear el dispositivo. La condici\u00f3n es alcanzable desde on_payload, y golioth_payload_is_null() no bloquea payload_size==1. Un servidor malicioso o MitM puede desencadenar una denegaci\u00f3n de servicio."}], "id": "CVE-2026-23748", "lastModified": "2026-07-14T16:16:52.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23748", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T16:06:13.053978Z", "version": "2.0.3"}}]}, "published": "2026-02-26T18:23:06.550", "references": [{"source": "disclosure@vulncheck.com", "url": "https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/golioth/golioth-firmware-sdk/commit/d7f55b380d8be8b29bd101ce06e421af2e88c12b"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0"}, {"source": "disclosure@vulncheck.com", "url": "https://secmate.dev/disclosures/SECMATE-2025-0016"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/golioth-firmware-sdk-lightdb-state-out-of-bounds-read"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.10.0,0.22.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "commit d7f55b38"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Firmware SDK", "source": "cna", "vendor": "Golioth"}, "product": "firmware_sdk", "vendor": "golioth"}], "analysis": {"en": {"generated_at": "2026-04-16T06:01:49.956097+00:00", "value": {"mitigation_remediation": ["Upgrade the Golioth Firmware SDK to version\u202f0.22.0 or newer, which incorporates the fixing commit.", "Configure the device to trust only authorized Golioth servers, enabling proper certificate validation and disabling unauthenticated connections to prevent MITM attacks.", "If patching is delayed, modify the firmware to reject or sanitize payloads with payload_size less than\u202f2 before processing, mitigating the underflow until a patch is applied."], "summary": {"action": "Apply Patch", "impact": "Device Crash (Denial of Service)"}, "threat_synthesis": {"affected_systems": "The issue affects all releases of the Golioth Firmware SDK prior to 0.22.0, including the publicly available 0.10.0 version. Users deploying these versions should check the SDK version in their firmware and update if necessary.", "description_and_impact": "The vulnerability is an out\u2011of\u2011bounds read in the LightDB state string parsing routine of the Golioth Firmware SDK. When a payload is received, a payload_size value less than 2 triggers a size_t underflow during nbytes calculation, causing a memcpy to read past the end of the network buffer. This can crash the device, leading to a denial\u2011of\u2011service condition.", "risk_and_exploitability": "The CVSS score of 6.3 indicates a moderate severity, while the EPSS score of less than 1\u202f% suggests a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. However, the vulnerability is remote and reachable from a malicious server or MITM attacker controlling the payload. Once triggered, the device will crash, so the attack can cause widespread service interruption if exploited on numerous endpoints."}}}}, "created": "2026-02-27T09:07:19.122005+00:00", "updated": "2026-04-16T06:15:26.884162+00:00", "vendors": ["golioth", "golioth$PRODUCT$firmware_sdk"]}