CVE-2026-23749
Out-of-Bounds Read in Golioth Firmware SDK Causes DoS
Publication date: 2026-02-26
Last updated on: 2026-02-27
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| golioth | golioth_firmware_sdk | to 0.22.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-170 | The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-23749 is an out-of-bounds read vulnerability in the Golioth Firmware SDK versions prior to 0.22.0. It occurs because the function blockwise_transfer_init() copies a path string using strncpy() without ensuring it is null-terminated. If the path length equals the maximum allowed length, the copied buffer remains unterminated. Later, when strlen() is called on this buffer, it can read beyond the allocated memory, potentially causing a crash or denial of service.
The input that triggers this vulnerability is controlled by the application, not by network input by default.
How can this vulnerability impact me? :
This vulnerability can lead to a crash or denial of service in applications using the affected Golioth Firmware SDK versions. Because the out-of-bounds read can cause memory safety violations, it may destabilize the system or interrupt normal operation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is triggered by application-controlled input rather than network input by default, making network detection less straightforward.
Detection would involve analyzing the usage of the blockwise_transfer_init() function in the Golioth Firmware SDK versions prior to 0.22.0 to see if paths of length equal to CONFIG_GOLIOTH_COAP_MAX_PATH_LEN are passed without proper null termination.
Since the issue involves an out-of-bounds read caused by improper null termination, one could use debugging or memory analysis tools to detect crashes or memory violations related to strlen() calls on the ctx->path buffer.
No specific commands or network detection signatures are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the Golioth Firmware SDK to version 0.22.0 or later, where the vulnerability has been fixed.
The fix ensures that the path copied into the blockwise transfer context is always null-terminated, preventing out-of-bounds reads.
If upgrading immediately is not possible, review and modify application code to ensure that any path passed to blockwise_transfer_init() is properly null-terminated and does not reach the maximum path length without a terminating null byte.