CVE-2026-23748Low· 3.7▾ TwilightPoC availableGolioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 20.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicious server or MITM can trigger a denial of service.
firmware_sdk >= 0.10.0 < 0.22.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-23747Low· 3.7Golioth Firmware SDK < 0.22.0 Payload Utils Stack-based Buffer Overflow
CVE-2026-23749Low· 2.9Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds Read
CVE-2024-32975Medium· 5.9Envoy crashes in QuicheDataReader::PeekVarInt62Length()
CVE-2025-26269Low· 3.3DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer.
CVE-2026-22185Medium· 4.6OpenLDAP LMDB mdb_load Heap Buffer Underflow in readline()
CVE-2026-111881High· 7.6FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard