CVE-2026-5855

Received Received - Intake

Buffer Overflow in Contiki-NG LwM2M TLV Parser

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. Corrupted tlv_len derived from the out-of-bounds memory further corrupts the caller's parse offset. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-5855

Affected Vendors & Products

Vendor	Product	Version / Range
contiki-ng	lwm2m	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves Contiki-NG's LwM2M TLV parser ignoring buffer length checks. It reads up to six bytes from input without bounds, causing out-of-bounds heap memory reads when a crafted CoAP WRITE supplies exactly one byte. This leaks memory contents like keys and addresses through parsed fields.

Detection Guidance

This vulnerability involves memory corruption in Contiki-NG's LwM2M TLV parser. Detection requires inspecting network traffic for malformed CoAP WRITE requests targeting LwM2M endpoints. Monitor for unusual memory access patterns or crashes in LwM2M-related processes. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to read sensitive memory, including cryptographic keys or peer addresses, potentially leading to further attacks. In LwM2M NoSec mode, no authentication is required, making exploitation easier for constrained devices.

Mitigation Strategies

Immediately update Contiki-NG to the latest patched version. Disable LwM2M NoSec mode if enabled and enforce authentication. Restrict network access to LwM2M endpoints via firewalls. Monitor for exploitation attempts in logs.

Hi! I’m here to help you understand CVE-2026-5855. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70