{"id":"CVE-2026-5855","summary":"Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read","details":"Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer, disclosing memory contents (including key material and peer addresses) through the parsed tlv-\u003eid, tlv-\u003elength, and tlv-\u003evalue fields. Corrupted tlv_len derived from the out-of-bounds memory further corrupts the caller's parse offset. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.","modified":"2026-08-09T03:30:21.778756521Z","published":"2026-08-06T18:39:06.869Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5855.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"f1673b5766d4d4d514cefb8a0350f43653574997"}]}],"cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5855.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5855"},{"type":"REPORT","url":"https://github.com/contiki-ng/contiki-ng/pull/3165"},{"type":"FIX","url":"https://github.com/contiki-ng/contiki-ng/commit/f1673b5766d4d4d514cefb8a0350f43653574997"},{"type":"PACKAGE","url":"https://github.com/contiki-ng/contiki-ng"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/contiki-ng/contiki-ng","events":[{"introduced":"0"},{"fixed":"f1673b5766d4d4d514cefb8a0350f43653574997"}],"database_specific":{"source":"REFERENCES"}}],"versions":["develop/v5.1","develop/v5.0","develop/v4.9","develop/v4.8","develop/v4.7","develop/v4.6","develop/v4.5","develop/v4.4","develop/v4.3","develop/v4.2","develop/v4.1","develop/v4.0","fork","develop/v3.x-fork","old/v2.6","2.6-rc0","2.6","2.5-release","old/v2.4","2.4","old/v2.3","2.3","old/v2.2.3","2.2.3","old/v2.2.2","2.2.2","old/v2.2.1","2.2.1","old/v2.2","2.2","old/v2.1","2.1","old/v2.0","2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5855.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}