Golioth Firmware SDK versions 0.10.0 up to but not including 0.22.0 contain a stack-based buffer overflow in the Payload Utils component. The functions golioth_payload_as_int() and golioth_payload_as_float() use memcpy() to copy payload data into fixed-size stack buffers, relying on assert() for length checks. Since asserts are removed in release builds, no effective bounds checking occurs, allowing payloads larger than the buffer sizes (12 bytes for int, 32 bytes for float) to overflow the stack. This vulnerability can be triggered remotely via LightDB State on_payload messages from a malicious or compromised server or via MITM attacks. The issue was fixed in commit 48f521b, included in version 0.22.0 and later.

Exploitation of this vulnerability can cause a stack-based buffer overflow leading to application crashes or denial of service on devices running affected versions of the Golioth Firmware SDK. There is no indication of code execution or privilege escalation in the provided data. The attack vector is remote network-based with no privileges or user interaction required, but requires the ability to send malicious payloads via LightDB State on_payload. No known exploits in the wild have been reported.

A fix for this vulnerability is available and was introduced in commit 48f521b. Users should upgrade to Golioth Firmware SDK version 0.22.0 or later to remediate this issue. Until upgrading, avoid processing untrusted payloads via LightDB State on_payload or implement additional input validation to ensure payload sizes do not exceed safe limits. Patch status is confirmed by the vendor commit; no cloud service remediation applies as this is an SDK vulnerability.