Golioth Firmware SDK versions prior to 0.22.0, including 0.10.0, contain a stack-based buffer overflow in the Payload Utils component. The functions golioth_payload_as_int() and golioth_payload_as_float() use memcpy() to copy payload data into fixed-size stack buffers, relying on assert() for length checks. Since asserts are removed in release builds, memcpy() may copy an unbounded payload_size, allowing payloads larger than the buffer sizes (12 bytes for int, 32 bytes for float) to overflow the stack. This can lead to a crash or denial of service. The vulnerability is reachable through LightDB State on_payload when interacting with a malicious server or via a man-in-the-middle attack. The issue is fixed in commit 48f521b, which corresponds to version 0.22.0 and later.

An attacker controlling the server or performing a man-in-the-middle attack can send a specially crafted payload that exceeds the expected size, causing a stack-based buffer overflow. This overflow can result in a crash of the affected device or denial of service. There is no indication of code execution or privilege escalation in the provided data. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on availability.

A fix is available in Golioth Firmware SDK version 0.22.0 and later, as implemented in commit 48f521b. Users should upgrade to version 0.22.0 or later to remediate this vulnerability. Until upgraded, avoid interacting with untrusted or potentially malicious servers to reduce exposure. Patch status is confirmed fixed in the vendor's commit; no additional vendor advisory was provided.