Is CVE-2026-23747 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23747 being exploited in the wild.

How severe is CVE-2026-23747?

Low severity, with a CVSS score of 3.7, published 26 February 2026.

Which products and versions are affected?

Golioth Firmware SDK 0.10.0 to 0.21.x.

Is there a fix for CVE-2026-23747?

A patch was published on 2023-12-19: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23747 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23747?

Check whether you run Golioth Firmware SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23747: Golioth Firmware SDK stack buffer overflow in Payload Utils

CVE-2026-23747 · Severity: low · CVSS 3.7 · Published 2026-02-26

The Golioth Firmware SDK, used for connecting IoT devices to the Golioth cloud platform, contains a flaw in how it processes incoming data. A malicious server or an attacker intercepting network traffic could send specially crafted messages that cause the device's software to crash. This results in a denial-of-service, potentially rendering the IoT device unresponsive until it is manually reset.

Technologies: Golioth Firmware SDK. Vendors: Golioth.

Quick answers

Is CVE-2026-23747 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23747 being exploited in the wild.
How severe is CVE-2026-23747?: Low severity, with a CVSS score of 3.7, published 26 February 2026.
Which products and versions are affected?: Golioth Firmware SDK 0.10.0 to 0.21.x.
Is there a fix for CVE-2026-23747?: A patch was published on 2023-12-19: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23747 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23747?: Check whether you run Golioth Firmware SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the golioth_payload_as_int() and golioth_payload_as_float() helper functions within the Golioth Firmware SDK. These functions use memcpy() to copy network-supplied data into fixed-size stack buffers (12 bytes for integers, 32 bytes for floats) using a length derived directly from the payload size. Because the length checks are implemented using assert() statements, they are removed in production release builds, allowing unbounded copies. An attacker acting as a malicious server or performing a Man-in-the-Middle (MITM) attack can trigger this via LightDB State on_payload messages to cause a crash. The issue is fixed in version 0.22.0 and commit 48f521b.

Affected products

Golioth Firmware SDK 0.10.0 to 0.21.x

Timeline

2023-12-19: patched: Fix committed to repository
2026-02-26: disclosed: Vulnerability disclosed by SecMate and VulnCheck
2026-02-26: advisory: NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.