Is CVE-2026-23750 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23750 being exploited in the wild.

How severe is CVE-2026-23750?

High severity, with a CVSS score of 8.1, published 26 February 2026.

Which products and versions are affected?

Golioth Pouch 0.1.0 prior to commit 1b2219a1.

Is there a fix for CVE-2026-23750?

A patch was published on 2026-02-26: Fix identified in commit 1b2219a1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23750 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-23750?

Check whether you run Golioth Pouch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23750: Golioth Pouch heap overflow in BLE GATT certificate handling

CVE-2026-23750 · Severity: high · CVSS 8.1 · Published 2026-02-26

Golioth Pouch, a firmware component for connecting IoT devices to the cloud, contains a security flaw in how it handles Bluetooth Low Energy (BLE) certificates. An attacker within Bluetooth range can send specially crafted data fragments that exceed the device's memory limits. This can lead to a system crash or allow the attacker to corrupt the device's memory, potentially compromising its integrity and operational stability.

Vendors: Golioth.

Quick answers

Is CVE-2026-23750 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23750 being exploited in the wild.
How severe is CVE-2026-23750?: High severity, with a CVSS score of 8.1, published 26 February 2026.
Which products and versions are affected?: Golioth Pouch 0.1.0 prior to commit 1b2219a1.
Is there a fix for CVE-2026-23750?: A patch was published on 2026-02-26: Fix identified in commit 1b2219a1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23750 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-23750?: Check whether you run Golioth Pouch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in Golioth Pouch version 0.1.0 within the BLE GATT server certificate handling logic. The function `server_cert_write()` in `server_cert_characteristic.c` allocates a heap buffer of size `CONFIG_POUCH_SERVER_CERT_MAX_LEN` upon receiving the first fragment but fails to validate the total size when appending subsequent fragments via `memcpy()`. An unauthenticated attacker within Bluetooth range (adjacent) can exploit this by sending fragments that exceed the maximum length, resulting in a heap overflow. This can cause a denial-of-service (crash) or arbitrary memory corruption. The issue is fixed in commit 1b2219a1.

Affected products

Golioth Pouch 0.1.0 prior to commit 1b2219a1

Timeline

2026-02-26: advisory: Initial disclosure by VulnCheck and SecMate
2026-02-26: patched: Fix identified in commit 1b2219a1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.