Executive brief
Golioth Firmware SDK, a software kit used to build and connect IoT devices to the Golioth cloud platform, contains a flaw in how it handles data from the LightDB State service. A malicious server or an attacker intercepting network traffic can send a specially crafted message that causes the device to crash. This results in a denial-of-service condition, potentially disrupting the operations of connected hardware.
Technical details
An integer underflow vulnerability exists in the LightDB State string parsing component of the Golioth Firmware SDK. When the `on_payload` function processes a string payload with a `payload_size` less than 2, the calculation for `nbytes` (intended to strip quotation marks) results in a `size_t` underflow. This leads to a large value being passed to `memcpy()`, causing an out-of-bounds read from the network buffer and a subsequent device crash. The vulnerability is reachable because `golioth_payload_is_null()` fails to block payloads with a size of 1. The issue is fixed in version 0.22.0 and commit d7f55b38.
Affected products
- Golioth Firmware SDK 0.10.0 to 0.21.x
Timeline
- 2026-02-26: advisory: Initial disclosure by VulnCheck and SecMate
- 2026-02-26: disclosed
- 2025-12-17: patched: Version 0.22.0 released with fix
References
- https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/
- https://github.com/golioth/golioth-firmware-sdk/commit/d7f55b380d8be8b29bd101ce06e421af2e88c12b
- https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0
- https://secmate.dev/disclosures/SECMATE-2025-0016
- https://www.vulncheck.com/advisories/golioth-firmware-sdk-lightdb-state-out-of-bounds-read