CVE-2026-23748

Name of the Vulnerable Software and Affected Versions Golioth Firmware SDK versions 0.10.0 through 0.21.9

Description The software contains an out-of-bounds read issue in LightDB State string parsing. A small payload size value (less than 2) can lead to a size t underflow when calculating the number of bytes to copy during string processing. This results in a memcpy() operation reading beyond the allocated network buffer, potentially causing a device crash. This condition is reachable through the on payload function, and the golioth payload is null() function does not prevent payloads of size 1 from being processed. A malicious server or a man-in-the-middle (MITM) attacker can trigger a denial of service.

Recommendations Update to version 0.22.0 or later.