Executive brief
The Golioth Firmware SDK, used for connecting IoT devices to the Golioth cloud platform, contains a flaw in how it processes incoming data. A malicious server or an attacker intercepting network traffic could send specially crafted messages that cause the device's software to crash. This results in a denial-of-service, potentially rendering the IoT device unresponsive until it is manually reset.
Technical details
A stack-based buffer overflow exists in the golioth_payload_as_int() and golioth_payload_as_float() helper functions within the Golioth Firmware SDK. These functions use memcpy() to copy network-supplied data into fixed-size stack buffers (12 bytes for integers, 32 bytes for floats) using a length derived directly from the payload size. Because the length checks are implemented using assert() statements, they are removed in production release builds, allowing unbounded copies. An attacker acting as a malicious server or performing a Man-in-the-Middle (MITM) attack can trigger this via LightDB State on_payload messages to cause a crash. The issue is fixed in version 0.22.0 and commit 48f521b.
Affected products
- Golioth Firmware SDK 0.10.0 to 0.21.x
Timeline
- 2023-12-19: patched: Fix committed to repository
- 2026-02-26: disclosed: Vulnerability disclosed by SecMate and VulnCheck
- 2026-02-26: advisory: NVD entry published
References
- https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/
- https://github.com/golioth/golioth-firmware-sdk/commit/48f521bcc0187ada2b9cbdad31dc380e6c7b7332
- https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0
- https://secmate.dev/disclosures/SECMATE-2025-0015
- https://www.vulncheck.com/advisories/golioth-firmware-sdk-payload-utils-stack-based-buffer-overflow