Executive brief
The Golioth Firmware SDK, used for connecting IoT devices to the Golioth cloud, contains a software flaw in how it handles internal data paths. If an application provides a specifically sized path string, the system may fail to properly mark the end of that data, leading to a memory error. This can cause the device firmware to crash, resulting in a denial of service, though it typically requires local access to the application rather than being directly exploitable over the network.
Technical details
An out-of-bounds read exists in the Golioth Firmware SDK within the blockwise_transfer_init() function. The vulnerability is caused by the use of strncpy() to copy a path of length CONFIG_GOLIOTH_COAP_MAX_PATH_LEN without ensuring a trailing NUL byte, leaving the destination buffer unterminated. A subsequent call to strlen() in golioth_coap_client_get_internal() can then read past the allocated buffer. This results in a crash or denial of service (DoS). While the input is application-controlled rather than network-controlled by default, it poses a risk to firmware stability. The issue is fixed in version 0.22.0 and commit 0e788217.
Affected products
- Golioth Firmware SDK 0.19.1 to 0.21.x (prior to 0.22.0)
Timeline
- 2026-02-26: advisory: Initial disclosure by SecMate and VulnCheck
- 2026-02-26: patched: Fixed in version 0.22.0
References
- https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/
- https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d
- https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0
- https://secmate.dev/disclosures/SECMATE-2025-0017
- https://www.vulncheck.com/advisories/golioth-firmware-sdk-blockwise-transfer-path-out-of-bounds-read