{"id":"CVE-2026-23747","summary":"Golioth Firmware SDK \u003c 0.22.0 Payload Utils Stack-based Buffer Overflow","details":"Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit 48f521b, contain a stack-based buffer overflow in Payload Utils. The golioth_payload_as_int() and golioth_payload_as_float() helpers copy network-supplied payload data into fixed-size stack buffers using memcpy() with a length derived from payload_size. The only length checks are guarded by assert(); in release builds, the asserts are compiled out and memcpy() may copy an unbounded payload_size. Payloads larger than 12 bytes (int) or 32 bytes (float) can overflow the stack, resulting in a crash/denial of service. This is reachable via LightDB State on_payload with a malicious server or MITM.","modified":"2026-08-12T03:51:34.416752581Z","published":"2026-02-26T17:30:13.495Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-121"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23747.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23747.json"},{"type":"ADVISORY","url":"https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23747"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/golioth-firmware-sdk-payload-utils-stack-based-buffer-overflow"},{"type":"FIX","url":"https://github.com/golioth/golioth-firmware-sdk/commit/48f521bcc0187ada2b9cbdad31dc380e6c7b7332"},{"type":"PACKAGE","url":"https://github.com/golioth/golioth-firmware-sdk"},{"type":"ARTICLE","url":"https://secmate.dev/disclosures/SECMATE-2025-0015"},{"type":"EVIDENCE","url":"https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/golioth/golioth-firmware-sdk","events":[{"introduced":"35c3085d0686b73b85cb7bd46c75adb828ce6a83"},{"fixed":"48f521bcc0187ada2b9cbdad31dc380e6c7b7332"},{"fixed":"f15281671a9dd5c14a5215021f4469a8e3071b37"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0.10.0"},{"fixed":"0.22.0"}]}}],"versions":["v0.20.0","v0.21.1","v0.21.0","v0.15.0","v0.19.1","v0.19.0","v0.18.1","v0.18.0","v0.17.0","v0.16.0","v0.14.0","v0.13.1","v0.13.0","v0.12.2","v0.12.1","v0.12.0","v0.11.1","v0.11.0","v0.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23747.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}