Security readout for executives and security teams
Plain-English summary
This is a low-severity crash bug in Golioth Firmware SDK blockwise transfer handling. A maximum-length application-supplied path may lack proper string termination, causing later code to read past the buffer and potentially crash the device or process.
Executive priority
Treat as routine remediation unless the affected SDK is in safety-critical devices or untrusted users can influence blockwise paths. Prioritize inventory and inclusion in the next firmware maintenance release.
Technical view
In Golioth Firmware SDK 0.19.1 before 0.22.0, blockwise_transfer_init() can copy a CONFIG_GOLIOTH_COAP_MAX_PATH_LEN path with strncpy() without a NUL terminator. A later strlen() in golioth_coap_client_get_internal() may read out of bounds, causing denial of service. The issue maps to CWE-170.
Likely exposure
Exposure is likely limited to firmware using affected Golioth SDK versions and application logic that supplies maximum-length blockwise transfer paths. The source bundle states the input is application-controlled and not network-reachable by default.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not establish active exploitation. CVSS marks local attack vector and high complexity, with availability impact only. Risk increases if product code lets untrusted data shape the path value.
Researcher notes
Evidence supports an unterminated string boundary bug with crash potential, not confidentiality or integrity impact. The public bundle does not prove default remote reachability, weaponized exploitation, or broader affected products beyond Golioth Firmware SDK versions before 0.22.0.
Mitigation direction
- Upgrade Golioth Firmware SDK to v0.22.0 or later.
- Backport commit 0e788217 if a full SDK upgrade is impractical.
- Review firmware release manifests for affected Golioth SDK versions.
- Ensure application code safely handles maximum-length blockwise paths.
- Check Golioth and downstream vendor guidance for firmware-specific updates.
Validation and detection
- Confirm deployed firmware uses SDK v0.22.0 or includes commit 0e788217.
- Search SBOMs and build manifests for Golioth Firmware SDK versions.
- Review calls reaching blockwise_transfer_init() for maximum-length path inputs.
- In a lab, exercise boundary-length paths and monitor for crashes.
- Verify no exposed interface can influence application-controlled path values.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-170: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-23749 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L1.41.4VulnCheckCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
2.1LowVector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Base CVSS 3.1 score
2.9LowVector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://secmate.dev/disclosures/SECMATE-2025-0017CVE reference, VulnCheck · technical-description
- https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/CVE reference, VulnCheck · technical-description, exploit
- https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0CVE reference, VulnCheck · release-notes
- https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26dCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/golioth-firmware-sdk-blockwise-transfer-path-out-of-bounds-readCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Null Termination
Improper Null Termination represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.