CVE-2026-23747 Overview
CVE-2026-23747 is a stack-based buffer overflow [CWE-121] in the Golioth Firmware SDK affecting versions 0.10.0 through 0.21.x. The flaw resides in the Payload Utils helpers golioth_payload_as_int() and golioth_payload_as_float(). Both functions copy network-supplied payload data into fixed-size stack buffers using memcpy(), with the copy length derived from the attacker-controlled payload_size field. Length validation relies solely on assert() macros, which are compiled out in release builds. Payloads larger than 12 bytes for integers or 32 bytes for floats overflow the stack and crash the device. A malicious LightDB State server or a network attacker performing a Machine-in-the-Middle (MITM) attack can trigger the condition remotely.
Critical Impact
Remote attackers can crash Golioth-connected IoT devices through the LightDB State on_payload handler, causing denial of service on embedded firmware.
Affected Products
- Golioth Firmware SDK version 0.10.0 through 0.21.x
- Devices using golioth_payload_as_int() or golioth_payload_as_float() helpers
- IoT firmware integrating LightDB State observation handlers
Discovery Timeline
- 2026-02-26 - CVE-2026-23747 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-23747
Vulnerability Analysis
The Golioth Firmware SDK exposes two helper functions in its Payload Utils module that parse incoming CoAP/LightDB payloads into numeric types. golioth_payload_as_int() allocates a 12-byte stack buffer to hold an integer representation. golioth_payload_as_float() allocates a 32-byte stack buffer for floating-point parsing. Both helpers call memcpy() to transfer payload bytes from the network into these buffers, using payload_size as the length argument.
The SDK guards the copy with assert() statements that verify payload_size does not exceed the buffer capacity. In production firmware built without debug assertions enabled, the compiler removes these checks. The memcpy() call then proceeds with an attacker-supplied length, writing past the end of the stack buffer.
Because the affected path is reachable through LightDB State on_payload, any server-pushed update or MITM-injected response containing an oversized payload triggers the overflow. The result is stack corruption and a device crash, producing denial of service across deployed IoT fleets.
Root Cause
The root cause is reliance on assert() for security-critical bounds checking. Assertions are a debugging aid and are typically stripped from release builds via NDEBUG. Replacing them with runtime length validation that returns an error code is required to enforce the buffer limits in production firmware.
Attack Vector
Exploitation requires network reachability to the device's LightDB State channel. An attacker controls payload contents through one of two paths: compromising or impersonating the Golioth backend server, or intercepting and modifying CoAP traffic between the device and the legitimate server. Sending a payload larger than 12 bytes to golioth_payload_as_int() or larger than 32 bytes to golioth_payload_as_float() overflows the stack buffer.
The vulnerability mechanism is described in the Secmate disclosure SECMATE-2025-0015 and the VulnCheck advisory. No public proof-of-concept exploit code is currently available.
Detection Methods for CVE-2026-23747
Indicators of Compromise
- Unexpected device reboots or watchdog resets shortly after receiving LightDB State updates
- CoAP payload frames addressed to LightDB observe handlers with payload lengths exceeding 12 or 32 bytes
- Firmware crash logs referencing golioth_payload_as_int or golioth_payload_as_float in the stack trace
Detection Strategies
- Inspect outbound and inbound CoAP traffic to coap.golioth.io for anomalously sized LightDB State payloads
- Monitor firmware crash telemetry for repeated faults correlated with cloud session activity
- Validate the deployed Golioth SDK version across the fleet and flag any build below 0.22.0
Monitoring Recommendations
- Enable verbose logging on Golioth client sessions during patch rollout to capture rejected oversized payloads
- Forward device crash dumps and connectivity metrics to a centralized telemetry pipeline for fleet-wide correlation
- Alert on TLS certificate mismatches or DTLS handshake anomalies that could indicate MITM positioning
How to Mitigate CVE-2026-23747
Immediate Actions Required
- Upgrade the Golioth Firmware SDK to version 0.22.0 or later, which includes fix commit 48f521b
- Audit firmware build configurations to confirm device-side TLS/DTLS certificate validation is enforced for the Golioth backend
- Inventory all production devices running SDK versions 0.10.0 through 0.21.x and prioritize OTA updates
Patch Information
The issue is fixed in commit 48f521b and shipped in Golioth SDK Release v0.22.0. The patch replaces the assert() guards with explicit runtime length checks that bound the memcpy() length to the destination buffer size and return an error on oversized payloads.
Workarounds
- Avoid calling golioth_payload_as_int() and golioth_payload_as_float() directly; parse payloads with application-level length validation before invoking the helpers
- Enforce strict server certificate pinning on devices to reduce MITM exposure on LightDB State channels
- Apply payload size limits at the application's LightDB observe callback before the data reaches the vulnerable helpers
# Update to fixed SDK version
git -C golioth-firmware-sdk fetch --tags
git -C golioth-firmware-sdk checkout v0.22.0
west update
west build -b <board> --pristine
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
