CVE-2026-23749

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23749", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-15T18:42:20.938Z", "datePublished": "2026-02-26T17:32:30.795Z", "dateUpdated": "2026-11-08T14:01:24.962Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:01:24.962Z"}, "title": "Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds Read", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Golioth Firmware SDK version&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">0.19.1</span>&nbsp;prior to 0.22.0, fixed in commit&nbsp;0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx-&gt;path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default)."}], "value": "Golioth Firmware SDK version\u00a00.19.1\u00a0prior to 0.22.0, fixed in commit\u00a00e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default)."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-170", "description": "CWE-170: Improper Null Termination", "lang": "en", "type": "CWE"}]}], "affected": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/golioth/golioth-firmware-sdk", "product": "Firmware SDK", "repo": "https://github.com/golioth/golioth-firmware-sdk", "vendor": "Golioth", "versions": [{"lessThan": "0.22.0", "status": "affected", "version": "0.19.1", "versionType": "semver"}, {"status": "unaffected", "version": "0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d", "versionType": "git"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 2.1, "baseSeverity": "LOW", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "references": [{"tags": ["technical-description"], "url": "https://secmate.dev/disclosures/SECMATE-2025-0017"}, {"tags": ["technical-description", "exploit"], "url": "https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/"}, {"tags": ["release-notes"], "url": "https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0", "name": "Firmware SDK 0.22.0 Release Notes"}, {"tags": ["patch"], "url": "https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/golioth-firmware-sdk-blockwise-transfer-path-out-of-bounds-read"}], "credits": [{"lang": "en", "type": "finder", "value": "SecMate (https://secmate.dev)"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T17:55:58.632725Z", "id": "CVE-2026-23749", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:56:08.833Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23749", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T17:55:58.632725Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:56:03.908Z"}}], "cna": {"title": "Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds Read", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "SecMate (https://secmate.dev)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/golioth/golioth-firmware-sdk", "vendor": "Golioth", "product": "Firmware SDK", "versions": [{"status": "affected", "version": "0.19.1", "lessThan": "0.22.0", "versionType": "semver"}, {"status": "unaffected", "version": "0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d", "versionType": "git"}], "packageURL": "pkg:github/golioth/golioth-firmware-sdk", "defaultStatus": "unaffected"}], "references": [{"url": "https://secmate.dev/disclosures/SECMATE-2025-0017", "tags": ["technical-description"]}, {"url": "https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0", "name": "Firmware SDK 0.22.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/golioth-firmware-sdk-blockwise-transfer-path-out-of-bounds-read", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Golioth Firmware SDK version\u00a00.19.1\u00a0prior to 0.22.0, fixed in commit\u00a00e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).", "supportingMedia": [{"type": "text/html", "value": "Golioth Firmware SDK version&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">0.19.1</span>&nbsp;prior to 0.22.0, fixed in commit&nbsp;0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx-&gt;path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-170", "description": "CWE-170: Improper Null Termination"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:01:24.962Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23749", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:01:24.962Z", "dateReserved": "2026-01-15T18:42:20.938Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-26T17:32:30.795Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/golioth/golioth-firmware-sdk", "product": "Firmware SDK", "repo": "https://github.com/golioth/golioth-firmware-sdk", "vendor": "Golioth", "versions": [{"lessThan": "0.22.0", "status": "affected", "version": "0.19.1", "versionType": "semver"}, {"status": "unaffected", "version": "0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Golioth Firmware SDK version\u00a00.19.1\u00a0prior to 0.22.0, fixed in commit\u00a00e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default)."}, {"lang": "es", "value": "Golioth Firmware SDK versi\u00f3n 0.19.1 anterior a la 0.22.0, corregido en el commit 0e788217, contiene una lectura fuera de l\u00edmites debido a una terminaci\u00f3n nula incorrecta de una ruta de transferencia por bloques. blockwise_transfer_init() acepta una ruta cuya longitud es igual a CONFIG_GOLIOTH_COAP_MAX_PATH_LEN y la copia usando strncpy() sin garantizar un byte NUL final, dejando ctx-&gt;path sin terminar. Un strlen() posterior en este b\u00fafer (en golioth_coap_client_get_internal()) puede leer m\u00e1s all\u00e1 del final de la asignaci\u00f3n, lo que resulta en un fallo/denegaci\u00f3n de servicio. La entrada es controlada por la aplicaci\u00f3n (no por la red por defecto)."}], "id": "CVE-2026-23749", "lastModified": "2026-07-14T16:16:52.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23749", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T17:55:58.632725Z", "version": "2.0.3"}}]}, "published": "2026-02-26T18:23:06.763", "references": [{"source": "disclosure@vulncheck.com", "url": "https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0"}, {"source": "disclosure@vulncheck.com", "url": "https://secmate.dev/disclosures/SECMATE-2025-0017"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/golioth-firmware-sdk-blockwise-transfer-path-out-of-bounds-read"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-170"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.19.1,0.22.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "commit 0e788217"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Firmware SDK", "source": "cna", "vendor": "Golioth"}, "product": "firmware_sdk", "vendor": "golioth"}], "analysis": {"en": {"generated_at": "2026-04-16T06:01:36.882463+00:00", "value": {"mitigation_remediation": ["Upgrade the Golioth Firmware SDK to version 0.22.0 or newer to eliminate the null\u2011termination bug.", "If an immediate SDK upgrade is infeasible, review and sanitize all application\u2011controlled paths passed to blockwise_transfer_init so that they are properly null\u2011terminated and within the maximum path length limits before being processed by the SDK.", "After applying changes, monitor device logs for any unexpected crashes or reboots that might indicate leftover vulnerabilities or path handling errors."], "summary": {"action": "Patch Update", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the Golioth Firmware SDK with versions 0.19.1 and earlier than 0.22.0. The issue is fixed in commit 0e788217 and subsequent releases such as 0.22.0 and later.", "description_and_impact": "Golioth Firmware SDK versions prior to 0.22.0 contain an out\u2011of\u2011bounds read that results from copying a blockwise transfer path into a fixed\u2011size buffer without appending a terminating NUL byte. The buffer is later processed with a strlen call, allowing the code to read beyond the allocated memory and trigger a crash. This flaw is a classic example of CWE\u2011170 Improper Null Termination and can lead to a denial of service for the device that is running the vulnerable SDK.", "risk_and_exploitability": "The CVSS score of 2.1 indicates low overall severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The attack surface is limited to application\u2011controlled input; the vulnerability is not remotely exploitable over the network by default. Even though exploitation would only cause a crash, the limited scope reduces the urgency but still warrants mitigation by upgrading the SDK."}}}}, "created": "2026-02-27T09:07:18.238396+00:00", "updated": "2026-04-16T06:15:26.883656+00:00", "vendors": ["golioth", "golioth$PRODUCT$firmware_sdk"]}