Is CVE-2026-23749 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23749 being exploited in the wild.

How severe is CVE-2026-23749?

Low severity, with a CVSS score of 2.9, published 26 February 2026.

Which products and versions are affected?

Golioth Firmware SDK 0.19.1 to 0.21.x (prior to 0.22.0).

Is there a fix for CVE-2026-23749?

A patch was published on 2026-02-26: Fixed in version 0.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23749 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-23749?

Check whether you run Golioth Firmware SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23749: Golioth Firmware SDK out-of-bounds read in blockwise transfer path

CVE-2026-23749 · Severity: low · CVSS 2.9 · Published 2026-02-26

The Golioth Firmware SDK, used for connecting IoT devices to the Golioth cloud, contains a software flaw in how it handles internal data paths. If an application provides a specifically sized path string, the system may fail to properly mark the end of that data, leading to a memory error. This can cause the device firmware to crash, resulting in a denial of service, though it typically requires local access to the application rather than being directly exploitable over the network.

Technologies: Golioth Firmware SDK. Vendors: Golioth.

Quick answers

Is CVE-2026-23749 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23749 being exploited in the wild.
How severe is CVE-2026-23749?: Low severity, with a CVSS score of 2.9, published 26 February 2026.
Which products and versions are affected?: Golioth Firmware SDK 0.19.1 to 0.21.x (prior to 0.22.0).
Is there a fix for CVE-2026-23749?: A patch was published on 2026-02-26: Fixed in version 0.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23749 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-23749?: Check whether you run Golioth Firmware SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read exists in the Golioth Firmware SDK within the blockwise_transfer_init() function. The vulnerability is caused by the use of strncpy() to copy a path of length CONFIG_GOLIOTH_COAP_MAX_PATH_LEN without ensuring a trailing NUL byte, leaving the destination buffer unterminated. A subsequent call to strlen() in golioth_coap_client_get_internal() can then read past the allocated buffer. This results in a crash or denial of service (DoS). While the input is application-controlled rather than network-controlled by default, it poses a risk to firmware stability. The issue is fixed in version 0.22.0 and commit 0e788217.

Affected products

Golioth Firmware SDK 0.19.1 to 0.21.x (prior to 0.22.0)

Timeline

2026-02-26: advisory: Initial disclosure by SecMate and VulnCheck
2026-02-26: patched: Fixed in version 0.22.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.