CVE-2026-23750: CWE-122 Heap-based Buffer Overflow in Golioth Pouch
Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption.
AI Analysis
Technical Summary
CVE-2026-23750 describes a heap-based buffer overflow in Golioth Pouch version 0.1.0 prior to commit 1b2219a1. The vulnerability arises in the BLE GATT server certificate handling code, specifically in server_cert_write(), which allocates a heap buffer sized by CONFIG_POUCH_SERVER_CERT_MAX_LEN upon receiving the first certificate fragment. Subsequent fragments are appended using memcpy() without bounds checking, enabling an adjacent BLE client to send unauthenticated fragments that exceed the allocated buffer size. This results in a heap overflow, causing application crash and possible memory corruption impacting data integrity.
Potential Impact
An attacker controlling an adjacent BLE client can trigger a heap overflow by sending oversized certificate fragments, leading to a crash of the Golioth Pouch BLE GATT server. Additionally, memory corruption may compromise the integrity of the application, potentially allowing further exploitation or denial of service. There is no indication of confidentiality or availability impact beyond the crash and integrity concerns.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable BLE GATT server to untrusted adjacent BLE clients or implement network-level controls to restrict access. Monitor vendor channels for updates or patches addressing this vulnerability.
CVE-2026-23750: CWE-122 Heap-based Buffer Overflow in Golioth Pouch
Description
Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption.
CVSS v4.0
Score 7.2high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-23750 describes a heap-based buffer overflow in Golioth Pouch version 0.1.0 prior to commit 1b2219a1. The vulnerability arises in the BLE GATT server certificate handling code, specifically in server_cert_write(), which allocates a heap buffer sized by CONFIG_POUCH_SERVER_CERT_MAX_LEN upon receiving the first certificate fragment. Subsequent fragments are appended using memcpy() without bounds checking, enabling an adjacent BLE client to send unauthenticated fragments that exceed the allocated buffer size. This results in a heap overflow, causing application crash and possible memory corruption impacting data integrity.
Potential Impact
An attacker controlling an adjacent BLE client can trigger a heap overflow by sending oversized certificate fragments, leading to a crash of the Golioth Pouch BLE GATT server. Additionally, memory corruption may compromise the integrity of the application, potentially allowing further exploitation or denial of service. There is no indication of confidentiality or availability impact beyond the crash and integrity concerns.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable BLE GATT server to untrusted adjacent BLE clients or implement network-level controls to restrict access. Monitor vendor channels for updates or patches addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-01-15T18:42:20.938Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69a0a1ca85912abc71d0bb54
Added to database: 02/26/2026, 19:40:58 UTC
Last enriched: 07/15/2026, 11:05:09 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 178
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.