CVE-2026-23749
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In Golioth Firmware SDK versions 0.19.1 through 0.21.0, there is an out-of-bounds read vulnerability due to improper null termination of a blockwise transfer path. The blockwise_transfer_init() function copies the path using strncpy() without guaranteeing a trailing NUL byte, leaving the buffer unterminated. A subsequent strlen() call on this buffer can read past the allocated memory, causing a crash or denial of service.
Risk Assessment
The risk is that an application can trigger a system crash, leading to device unavailability. The vulnerability is application-controlled, not network-triggered by default, which limits remote exploitation but can be exploited locally if misconfigured.
Recommendation
Upgrade Golioth Firmware SDK to version 0.22.0 or later, which includes the fix in commit 0e788217. If an upgrade is not possible, ensure proper null termination of the path in the application code.
Original NVD description (English source)
Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).