CVE-2026-23750

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23750", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-15T18:42:20.938Z", "datePublished": "2026-02-26T17:33:13.261Z", "dateUpdated": "2026-07-14T15:53:38.416Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T15:53:38.416Z"}, "title": "Golioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer Overflow", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption."}], "value": "Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "affected": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/golioth/pouch", "product": "Pouch", "repo": "https://github.com/golioth/pouch", "vendor": "Golioth", "versions": [{"status": "affected", "version": "0.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "1b2219a159bcbef3f37caa303bbf14d14e979c11", "versionType": "git"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 7.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "references": [{"tags": ["technical-description"], "url": "https://secmate.dev/disclosures/SECMATE-2025-0018"}, {"tags": ["technical-description", "exploit"], "url": "https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/"}, {"tags": ["patch"], "url": "https://github.com/golioth/pouch/commit/1b2219a1"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/golioth-pouch-ble-gatt-heap-based-buffer-overflow"}], "credits": [{"lang": "en", "type": "finder", "value": "SecMate (https://secmate.dev)"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "source": {"discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T16:05:25.263905Z", "id": "CVE-2026-23750", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T16:05:34.974Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23750", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-27T16:05:25.263905Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T16:05:29.715Z"}}], "cna": {"title": "Golioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer Overflow", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "SecMate (https://secmate.dev)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/golioth/pouch", "vendor": "Golioth", "product": "Pouch", "versions": [{"status": "affected", "version": "0.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "1b2219a159bcbef3f37caa303bbf14d14e979c11", "versionType": "git"}], "packageURL": "pkg:github/golioth/pouch", "defaultStatus": "unaffected"}], "references": [{"url": "https://secmate.dev/disclosures/SECMATE-2025-0018", "tags": ["technical-description"]}, {"url": "https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/golioth/pouch/commit/1b2219a1", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/golioth-pouch-ble-gatt-heap-based-buffer-overflow", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption.", "supportingMedia": [{"type": "text/html", "value": "Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T15:53:38.416Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23750", "state": "PUBLISHED", "dateUpdated": "2026-07-14T15:53:38.416Z", "dateReserved": "2026-01-15T18:42:20.938Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-26T17:33:13.261Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/golioth/pouch", "product": "Pouch", "repo": "https://github.com/golioth/pouch", "vendor": "Golioth", "versions": [{"status": "affected", "version": "0.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "1b2219a159bcbef3f37caa303bbf14d14e979c11", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption."}, {"lang": "es", "value": "Golioth Pouch versi\u00f3n 0.1.0, anterior al commit 1b2219a1, contiene un desbordamiento de b\u00fafer basado en mont\u00edculo en el manejo de certificados del servidor BLE GATT. server_cert_write() asigna un b\u00fafer de mont\u00edculo del tama\u00f1o CONFIG_POUCH_SERVER_CERT_MAX_LEN al recibir el primer fragmento, luego a\u00f1ade fragmentos subsiguientes usando memcpy() sin verificar que quede suficiente capacidad. Un cliente BLE adyacente puede enviar fragmentos no autenticados cuyo tama\u00f1o combinado excede el b\u00fafer asignado, causando un desbordamiento de mont\u00edculo y un fallo; tambi\u00e9n es posible un impacto en la integridad debido a la corrupci\u00f3n de memoria."}], "id": "CVE-2026-23750", "lastModified": "2026-07-14T16:16:53.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23750", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T16:05:25.263905Z", "version": "2.0.3"}}]}, "published": "2026-02-26T18:23:06.980", "references": [{"source": "disclosure@vulncheck.com", "url": "https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/golioth/pouch/commit/1b2219a1"}, {"source": "disclosure@vulncheck.com", "url": "https://secmate.dev/disclosures/SECMATE-2025-0018"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/golioth-pouch-ble-gatt-heap-based-buffer-overflow"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.1.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "commit 1b2219a1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Pouch", "source": "cna", "vendor": "Golioth"}, "product": "pouch", "vendor": "golioth"}], "analysis": {"en": {"generated_at": "2026-04-16T06:01:15.894916+00:00", "value": {"mitigation_remediation": ["Upgrade Golioth Pouch to a version that incorporates commit 1b2219a1 or later.", "Modify server_cert_write() to enforce strict bounds checking against CONFIG_POUCH_SERVER_CERT_MAX_LEN before each memcpy operation.", "If a patch cannot be applied immediately, disable or limit the BLE GATT server so that only authenticated clients can connect, or block BLE traffic to the device entirely."], "summary": {"action": "Patch immediately", "impact": "Heap-based buffer overflow causing memory corruption and potential compromise of integrity"}, "threat_synthesis": {"affected_systems": "The vulnerable product is Golioth Pouch, a BLE GATT server application released by Golioth. The issue affects version 0.1.0 and any releases before the security commit identified by hash 1b2219a1, which provides the necessary fix.", "description_and_impact": "Golioth Pouch version 0.1.0 before commit 1b2219a1 contains a heap-based buffer overflow in the BLE GATT server certificate handling. The server_cert_write() routine allocates a buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment and later uses memcpy() to append subsequent fragments without verifying that the buffer still has enough capacity. An unauthenticated BLE client can send fragments whose combined size exceeds the allocated buffer, leading to a heap overflow that can crash the service and, because memory corruption is involved, also threaten the integrity of data stored on the device.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation in the current landscape, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an attacker with the ability to communicate over BLE with the affected device could send unauthenticated certificate fragments that exceed the predetermined buffer limit. This would trigger a heap overflow, potentially leading to a crash and memory corruption that can alter device state."}}}}, "created": "2026-02-27T09:07:17.302293+00:00", "title": "Heap\u2011Based Buffer Overflow in Golioth Pouch BLE GATT Certificate Handling", "updated": "2026-04-16T06:15:26.882799+00:00", "vendors": ["golioth", "golioth$PRODUCT$pouch"]}