Golioth Firmware SDK up to 0.21.x LightDB State String Parser memcpy payload_size integer underflow

Summaryinfo

A vulnerability marked as problematic has been reported in Golioth Firmware SDK up to 0.21.x. Impacted is the function memcpy of the component LightDB State String Parser. The manipulation of the argument payload_size leads to integer underflow. This vulnerability is listed as CVE-2026-23748. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Golioth Firmware SDK up to 0.21.x. This issue affects the function memcpy of the component LightDB State String Parser. The manipulation of the argument payload_size with an unknown input leads to a integer underflow vulnerability. Using CWE to declare the problem leads to CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. Impacted is availability. The summary by CVE is:

Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service.

The weakness was presented by Secmate. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-23748 since 01/15/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.22.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch d7f55b380d8be8b29bd101ce06e421af2e88c12b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firmware Software

Vendor

• Golioth

Name

• Firmware SDK

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion