Security readout for executives and security teams
Plain-English summary
A flaw in older Golioth Firmware SDK builds can let a malicious server or man-in-the-middle crash an IoT device by sending a malformed LightDB State string payload. The known impact is device availability, not data theft or code execution, based on the supplied sources.
Executive priority
Treat this as a moderate availability risk for connected devices. Prioritize fleets where downtime creates operational cost, safety concerns, or field-service burden. Patch during the next controlled firmware update cycle unless exposed devices have high MITM or server-trust risk.
Technical view
In Golioth Firmware SDK 0.10.0 before 0.22.0, LightDB State string parsing can underflow a size_t when payload_size is less than 2. The resulting memcpy reads beyond the network buffer and may crash the device. The issue is reachable from on_payload and fixed in commit d7f55b38.
Likely exposure
Exposure is likely limited to firmware using affected Golioth Firmware SDK versions and LightDB State processing. Risk is higher where devices could receive payloads from an untrusted server path or a feasible MITM position.
Exploitation context
The source bundle says a malicious server or MITM can trigger denial of service. KEV is false, and the supplied sources do not establish active exploitation in the wild. Public technical details exist, including an exploit-tagged disclosure reference.
Researcher notes
The evidence supports CWE-191 integer underflow leading to out-of-bounds read and denial of service. The supplied affected-version data is somewhat terse, so validate exact dependency ranges against the vendor release and commit before broad fleet conclusions.
Mitigation direction
- Upgrade affected firmware builds to Golioth Firmware SDK v0.22.0 or later.
- Confirm commit d7f55b38 is included where version tags are unreliable.
- Review Golioth release notes and Secmate disclosure for integration-specific guidance.
- Prioritize remediation for devices with feasible server compromise or MITM exposure.
Validation and detection
- Inventory firmware builds for Golioth Firmware SDK versions 0.10.0 through before 0.22.0.
- Confirm LightDB State functionality is present and reachable in affected device firmware.
- Verify patched builds include the fixed LightDB State string parsing code.
- Check device crash telemetry for malformed payload handling failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-191: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-23748 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L2.21.4VulnCheckVulnerability scoring details
Base CVSS 4.0 score
6.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Base CVSS 3.1 score
3.7LowVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://secmate.dev/disclosures/SECMATE-2025-0016CVE reference, VulnCheck · technical-description
- https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/CVE reference, VulnCheck · technical-description, exploit
- https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0CVE reference, VulnCheck · release-notes
- https://github.com/golioth/golioth-firmware-sdk/commit/d7f55b380d8be8b29bd101ce06e421af2e88c12bCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/golioth-firmware-sdk-lightdb-state-out-of-bounds-readCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Underflow (Wrap or Wraparound)
Integer Underflow (Wrap or Wraparound) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.