CVE-2026-5855 in Contiki-NG
Summary
by MITRE • 08/07/2026
Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. Corrupted tlv_len derived from the out-of-bounds memory further corrupts the caller's parse offset. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability resides in Contiki-NG's implementation of the Lightweight Machine to Machine protocol where the lwm2m_tlv_read() function in os/services/lwm2m/lwm2m-tlv.c fails to properly validate buffer boundaries during TLV parsing operations. This flaw represents a classic buffer overflow condition that maps to CWE-129 and CWE-787, as the parser disregards the caller-supplied buffer length parameter and performs unbounded reads of up to six bytes from the input buffer without any validation checks. The function operates under the assumption that sufficient data exists in the buffer, creating a scenario where memory access occurs beyond intended boundaries.
The operational impact of this vulnerability is significant particularly within constrained IoT environments where Contiki-NG devices operate. When a malicious actor crafts a CoAP WRITE request to any LwM2M endpoint, specifically targeting a TLV structure that contains exactly one byte in its final TLV element, the parser executes five out-of-bounds memory reads from adjacent heap locations. These memory accesses expose sensitive information including cryptographic key material, peer network addresses, and other confidential data through the parsed tlv->id, tlv->length, and tlv->value fields. The vulnerability manifests as a memory disclosure attack that can reveal system internals and potentially compromise device security.
The root cause stems from improper bounds checking within the LwM2M engine where lwm2m-engine.c iterates based on the presence of at least one byte remaining in the buffer, but the lwm2m_tlv_read() function does not respect this boundary constraint. This mismatch allows for out-of-bounds memory access patterns that can corrupt data structures and potentially lead to further exploitation. The corruption extends beyond simple information disclosure as the tlv_len field derived from corrupted memory values further impacts the caller's parse offset, creating a cascading effect that can disrupt normal parsing operations and potentially enable more sophisticated attacks. This vulnerability aligns with ATT&CK technique T1082 for system information discovery and T1567 for exfiltration through data manipulation.
The absence of authentication requirements in LwM2M NoSec mode, which serves as the default configuration for constrained devices, significantly amplifies the threat landscape. Devices operating without security mechanisms make the vulnerability exploitable through unauthenticated network traffic, eliminating access control barriers that would otherwise prevent such attacks. This default insecure configuration creates an environment where any attacker with network access can potentially exploit the memory disclosure vulnerability to gather sensitive information from compromised devices. The combination of this buffer overflow in the TLV parser with the lack of authentication mechanisms transforms what could be a limited information disclosure into a serious security compromise that affects the confidentiality and integrity of IoT device communications.