# CVE-2026-23747: Golioth Firmware SDK stack buffer overflow in Payload Utils

Source: https://junglewise.ai/threats/cve-2026-23747-golioth-firmware-sdk-stack-buffer-overflow-in-payload-utils  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-26. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-23747 · Severity: low · CVSS 3.7 · Published 2026-02-26

The Golioth Firmware SDK, used for connecting IoT devices to the Golioth cloud platform, contains a flaw in how it processes incoming data. A malicious server or an attacker intercepting network traffic could send specially crafted messages that cause the device's software to crash. This results in a denial-of-service, potentially rendering the IoT device unresponsive until it is manually reset.

Technologies: [Golioth Firmware SDK](https://junglewise.ai/threats/technologies/firmware-sdk). Vendors: [Golioth](https://junglewise.ai/threats/vendors/golioth).

## Quick answers

**Is CVE-2026-23747 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23747 being exploited in the wild.

**How severe is CVE-2026-23747?** Low severity, with a CVSS score of 3.7, published 26 February 2026.

**Which products and versions are affected?** Golioth Firmware SDK 0.10.0 to 0.21.x.

**Is there a fix for CVE-2026-23747?** A patch was published on 2023-12-19: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23747 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-23747?** Check whether you run Golioth Firmware SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the golioth_payload_as_int() and golioth_payload_as_float() helper functions within the Golioth Firmware SDK. These functions use memcpy() to copy network-supplied data into fixed-size stack buffers (12 bytes for integers, 32 bytes for floats) using a length derived directly from the payload size. Because the length checks are implemented using assert() statements, they are removed in production release builds, allowing unbounded copies. An attacker acting as a malicious server or performing a Man-in-the-Middle (MITM) attack can trigger this via LightDB State on_payload messages to cause a crash. The issue is fixed in version 0.22.0 and commit 48f521b.

## Affected products

- Golioth Firmware SDK 0.10.0 to 0.21.x

## Timeline

- 2023-12-19: patched: Fix committed to repository
- 2026-02-26: disclosed: Vulnerability disclosed by SecMate and VulnCheck
- 2026-02-26: advisory: NVD entry published

## References

- [https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/](https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/)
- [https://github.com/golioth/golioth-firmware-sdk/commit/48f521bcc0187ada2b9cbdad31dc380e6c7b7332](https://github.com/golioth/golioth-firmware-sdk/commit/48f521bcc0187ada2b9cbdad31dc380e6c7b7332)
- [https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0](https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0)
- [https://secmate.dev/disclosures/SECMATE-2025-0015](https://secmate.dev/disclosures/SECMATE-2025-0015)
- [https://www.vulncheck.com/advisories/golioth-firmware-sdk-payload-utils-stack-based-buffer-overflow](https://www.vulncheck.com/advisories/golioth-firmware-sdk-payload-utils-stack-based-buffer-overflow)

## Related threats

- [Golioth Firmware SDK out-of-bounds read in blockwise transfer path](https://junglewise.ai/threats/cve-2026-23749-golioth-firmware-sdk-out-of-bounds-read-in-blockwise-transfer)
- [Golioth Firmware SDK out-of-bounds read in LightDB State string parsing](https://junglewise.ai/threats/cve-2026-23748-golioth-firmware-sdk-out-of-bounds-read-in-lightdb-state-string)