The vulnerability in Contiki-NG's LwM2M TLV parser (lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c) is due to ignoring the caller-supplied buffer length argument and reading up to six bytes without bounds checking. The caller in lwm2m-engine.c iterates while at least one byte remains, enabling a crafted CoAP WRITE message with a final TLV of exactly one byte to trigger up to five out-of-bounds heap reads adjacent to the input buffer. This results in disclosure of memory contents through the parsed TLV fields (id, length, value). Additionally, corrupted TLV length values cause further parse offset corruption. Exploitation is feasible without authentication in the default NoSec mode used by constrained devices.

An attacker can remotely send a specially crafted CoAP WRITE request to any LwM2M endpoint, causing out-of-bounds reads that disclose sensitive heap memory contents including key material and peer addresses. This memory disclosure can compromise confidentiality of sensitive data. The vulnerability does not directly impact confidentiality, integrity, or availability according to the CVSS vector, but the CVSS base score indicates high severity due to the potential for information disclosure and parse corruption. No authentication is required in the default NoSec mode, increasing the attack surface on constrained devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling LwM2M NoSec mode or restricting access to LwM2M endpoints to trusted networks to reduce exposure. Monitor vendor channels for official fixes or updates addressing this vulnerability.