Out-of-Bounds Read and Heap Overflow in libcoap OSCORE Parsing

Publication date: 2026-04-17

Last updated on: 2026-06-02

Assigner: VulnCheck

Description

libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause out-of-bounds reads through integer wraparound in allocation size computation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-17

Last Modified

2026-06-02

Generated

2026-07-06

AI Q&A

2026-04-18

EPSS Evaluated

2026-07-05

NVD

CVE-2026-29013

EUVD

EUVD-2026-23535

Affected Vendors & Products

Vendor	Product	Version / Range
libcoap	libcoap	to 4.3.5b (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in libcoap's handling of OSCORE Appendix B.2 CBOR unwrap processing. Specifically, the function get_byte_inc() in src/oscore/oscore_cbor.c uses assert() for bounds checking, which is removed in release builds compiled with NDEBUG. As a result, attackers can send specially crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation. This can trigger out-of-bounds reads during CBOR parsing and may lead to heap buffer overflow writes caused by integer wraparound in allocation size calculations.

Impact Analysis

The vulnerability can allow attackers to cause out-of-bounds memory reads and potentially heap buffer overflow writes. This can lead to memory corruption, which might be exploited to crash the application, cause denial of service, or execute arbitrary code remotely without any privileges or user interaction.

Hi! I’m here to help you understand CVE-2026-29013. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70