# CVE-2026-23749: Golioth Firmware SDK out-of-bounds read in blockwise transfer path

Source: https://junglewise.ai/threats/cve-2026-23749-golioth-firmware-sdk-out-of-bounds-read-in-blockwise-transfer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-26. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-23749 · Severity: low · CVSS 2.9 · Published 2026-02-26

The Golioth Firmware SDK, used for connecting IoT devices to the Golioth cloud, contains a software flaw in how it handles internal data paths. If an application provides a specifically sized path string, the system may fail to properly mark the end of that data, leading to a memory error. This can cause the device firmware to crash, resulting in a denial of service, though it typically requires local access to the application rather than being directly exploitable over the network.

Technologies: [Golioth Firmware SDK](https://junglewise.ai/threats/technologies/firmware-sdk). Vendors: [Golioth](https://junglewise.ai/threats/vendors/golioth).

## Quick answers

**Is CVE-2026-23749 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23749 being exploited in the wild.

**How severe is CVE-2026-23749?** Low severity, with a CVSS score of 2.9, published 26 February 2026.

**Which products and versions are affected?** Golioth Firmware SDK 0.19.1 to 0.21.x (prior to 0.22.0).

**Is there a fix for CVE-2026-23749?** A patch was published on 2026-02-26: Fixed in version 0.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23749 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-23749?** Check whether you run Golioth Firmware SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read exists in the Golioth Firmware SDK within the blockwise_transfer_init() function. The vulnerability is caused by the use of strncpy() to copy a path of length CONFIG_GOLIOTH_COAP_MAX_PATH_LEN without ensuring a trailing NUL byte, leaving the destination buffer unterminated. A subsequent call to strlen() in golioth_coap_client_get_internal() can then read past the allocated buffer. This results in a crash or denial of service (DoS). While the input is application-controlled rather than network-controlled by default, it poses a risk to firmware stability. The issue is fixed in version 0.22.0 and commit 0e788217.

## Affected products

- Golioth Firmware SDK 0.19.1 to 0.21.x (prior to 0.22.0)

## Timeline

- 2026-02-26: advisory: Initial disclosure by SecMate and VulnCheck
- 2026-02-26: patched: Fixed in version 0.22.0

## References

- [https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/](https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/)
- [https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d](https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d)
- [https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0](https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0)
- [https://secmate.dev/disclosures/SECMATE-2025-0017](https://secmate.dev/disclosures/SECMATE-2025-0017)
- [https://www.vulncheck.com/advisories/golioth-firmware-sdk-blockwise-transfer-path-out-of-bounds-read](https://www.vulncheck.com/advisories/golioth-firmware-sdk-blockwise-transfer-path-out-of-bounds-read)

## Related threats

- [Golioth Firmware SDK out-of-bounds read in LightDB State string parsing](https://junglewise.ai/threats/cve-2026-23748-golioth-firmware-sdk-out-of-bounds-read-in-lightdb-state-string)
- [Golioth Firmware SDK stack buffer overflow in Payload Utils](https://junglewise.ai/threats/cve-2026-23747-golioth-firmware-sdk-stack-buffer-overflow-in-payload-utils)