Golioth Firmware SDK versions 0.10.0 up to but not including 0.22.0 contain an integer underflow vulnerability (CWE-191) in the LightDB State string parsing logic. When processing a string payload with a payload_size less than 2, the calculation of bytes to copy (nbytes) underflows due to size_t wrapping, causing memcpy to read beyond the network buffer boundary. This leads to an out-of-bounds read and can crash the device, enabling denial of service. The vulnerability is reachable from the on_payload function, and the existing check golioth_payload_is_null() does not prevent payload_size==1. The vulnerability was fixed in commit d7f55b38.

An attacker controlling the server or positioned as a man-in-the-middle can send crafted payloads with a payload_size less than 2, triggering an out-of-bounds read that crashes the device. This results in a denial of service condition. There is no indication of code execution or data disclosure from the provided data.

A fix is available and was introduced in commit d7f55b38, which resolves the integer underflow and out-of-bounds read issue. Users should upgrade to Golioth Firmware SDK version 0.22.0 or later. No other mitigations are indicated.