CVE-2026-5855

Name of the Vulnerable Software and Affected Versions Contiki-NG (affected versions not specified)

Description The LwM2M TLV parser lwm2m tlv read() in os/services/lwm2m/lwm2m-tlv.c fails to validate the caller-supplied buffer length, reading up to six bytes from the input buffer without bounds checking. A crafted CoAP WRITE request to any LwM2M endpoint where the final TLV provides exactly one byte can trigger out-of-bounds reads of heap memory adjacent to the CoAP input buffer. This allows the disclosure of sensitive memory contents, such as key material and peer addresses, via the tlv->id, tlv->length, and tlv->value fields. Additionally, the corrupted tlv len derived from this memory access can corrupt the caller's parse offset. In LwM2M NoSec mode, which is the default for constrained devices, this can be exploited without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.