CVE-2026-14368

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A one-byte out-of-bounds write occurs in the LwM2M JSON content formatter when copying a parsed JSON string into a buffer. The issue exists in the get string() function within subsys/net/lib/lwm2m/lwm2m rw json.c because the length guard allows strings with a length exactly equal to the buffer size. When such a string is processed, the subsequent NUL-termination writes a 0x00 byte immediately past the end of the buffer, potentially corrupting adjacent memory, such as resource values, length fields, or structure fields, which may lead to data corruption or a system crash.

This can be triggered during a LwM2M WRITE operation where do write op json() parses a CoAP payload and get string() is called via lwm2m write handler() (specifically engine get string() in subsys/net/lib/lwm2m/lwm2m message handling.c) for a LWM2M RES TYPE STRING resource. The overflow affects either the resource instance's fixed data buffer res inst->data ptr or the engine validation buffer msg->ctx->validate buf.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.