The vulnerability occurs in subsys/net/lib/lwm2m/lwm2m_pull_context.c where the firmware-update Package URI is copied into a fixed static buffer (context.uri) of size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN (default 128) using memcpy without validating the length of the source URI. The server-supplied Package URI can be up to 255 bytes, but only the first 128 bytes are copied without a null terminator, causing subsequent functions that treat context.uri as a C string to read out-of-bounds memory. This out-of-bounds read leaks adjacent static memory contents appended to outbound CoAP requests, potentially disclosing sensitive information to the server or proxy. Additionally, this can cause device crashes resulting in denial of service. The vulnerability was introduced in version 3.0.0 and is present through 4.4.0. The fix involves checking that the URI length is less than the buffer size and using strcpy to guarantee a null-terminated string, preventing out-of-bounds reads.

An unauthenticated network attacker or an on-path attacker on a session without strong DTLS can supply a crafted Package URI that triggers an out-of-bounds read of adjacent device memory. This leads to information disclosure of potentially sensitive memory contents to the attacker. Additionally, the malformed buffer can cause device crashes, resulting in denial of service. The vulnerability does not allow code execution or integrity compromise but poses a confidentiality and availability risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix adds a length check and ensures null termination of the buffer to prevent out-of-bounds reads. Until an official patch or update is applied, avoid exposing the LwM2M firmware update service to untrusted networks or ensure strong DTLS protection to prevent on-path attackers from injecting malicious URIs.