CVE-2026-23749Low· 2.9▾ TwilightPoC availableGolioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONF…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 16 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).
firmware_sdk >= 0.19.1 < 0.22.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-23747Low· 3.7Golioth Firmware SDK < 0.22.0 Payload Utils Stack-based Buffer Overflow
CVE-2026-23748Low· 3.7Golioth Firmware SDK < 0.22.0 LightDB State Out-of-Bounds Read
CVE-2026-121943Medium· 4.8Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet
CVE-2026-5067Critical· 9.8A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header
CVE-2026-2239Low· 2.8Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow
CVE-2026-57185Medium· 6.5Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser