CVE-2026-23748

Katalog CVE

CVSS 3.7 · Low EPSS 0,27%

Kerentanan Integer Underflow (Wrap or Wraparound). Skor CVSS 3.1 3.7 (Low) menurut vulncheck.com.

Deskripsi (NVD)

Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service.

Rincian

Terbit di NVD

26 Februari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Deferred

CVSS 3.1

3.7 (Low), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-191: Integer Underflow (Wrap or Wraparound)

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/
• https://github.com/golioth/golioth-firmware-sdk/commit/d7f55b380d8be8b29bd101ce06e421af2e88c12b
• https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0
• https://secmate.dev/disclosures/SECMATE-2025-0016
• https://www.vulncheck.com/advisories/golioth-firmware-sdk-lightdb-state-out-of-bounds-read