CVE-2026-23748: Golioth Firmware SDK out-of-bounds read in LightDB State string parsing

CVE-2026-23748 · Severity: low · CVSS 3.7 · Published 2026-02-26

Golioth Firmware SDK, a software kit used to build and connect IoT devices to the Golioth cloud platform, contains a flaw in how it handles data from the LightDB State service. A malicious server or an attacker intercepting network traffic can send a specially crafted message that causes the device to crash. This results in a denial-of-service condition, potentially disrupting the operations of connected hardware.

Technologies: Golioth Firmware SDK. Vendors: Golioth.

Quick answers

Is CVE-2026-23748 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23748 being exploited in the wild.
How severe is CVE-2026-23748?
Low severity, with a CVSS score of 3.7, published 26 February 2026.
Which products and versions are affected?
Golioth Firmware SDK 0.10.0 to 0.21.x.
Is there a fix for CVE-2026-23748?
A patch was published on 2025-12-17: Version 0.22.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23748 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-23748?
Check whether you run Golioth Firmware SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow vulnerability exists in the LightDB State string parsing component of the Golioth Firmware SDK. When the `on_payload` function processes a string payload with a `payload_size` less than 2, the calculation for `nbytes` (intended to strip quotation marks) results in a `size_t` underflow. This leads to a large value being passed to `memcpy()`, causing an out-of-bounds read from the network buffer and a subsequent device crash. The vulnerability is reachable because `golioth_payload_is_null()` fails to block payloads with a size of 1. The issue is fixed in version 0.22.0 and commit d7f55b38.

Affected products

  • Golioth Firmware SDK 0.10.0 to 0.21.x

Timeline

  • 2026-02-26: advisory: Initial disclosure by VulnCheck and SecMate
  • 2026-02-26: disclosed
  • 2025-12-17: patched: Version 0.22.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.